fix(inference): create missing compatible provider (#7746)

<!-- markdownlint-disable MD041 -->
## Summary

Fix `nemoclaw inference set` when a direct compatible provider is absent
or its endpoint changes. NemoClaw now inspects the provider binding
before route selection, creates and verifies an absent provider before
the first route attempt, and commits a verified update for an existing
provider after route selection so failures can restore the prior
selection.

## Related Issue

Fixes #7725

## Changes

- Treat the OpenShell 0.0.85 generic `provider get` missing-entity
response as an absent provider only inside the exact-name provider
lookup.
- Inspect direct compatible provider bindings before route selection;
create and verify absent providers before the first route attempt.
- Update and verify existing direct compatible providers after
successful route selection, restoring the previous selection if the
provider update fails.
- Retry route selection once only for a correlated provider-not-found
result, and remove a newly created provider if route selection fails.
- Keep credential lookup behind an injected resolver so
route-containment tests do not depend on the host environment.
- Generalize the provider-binding helper for HTTPS Pin Runtime and
direct compatible routes.
- Add regressions for HTTPS IP-literal, DNS-pinned HTTP, generic
lookup-miss, and changed existing-provider endpoint behavior.
- Document compatible-provider preparation, retry, rollback, and HTTPS
Pin Runtime ordering.
- Align the workflow-boundary Vitest timeout with its existing 30-second
child-process budget after the same CI test timed out twice.

The compatibility path is required by #7725 for the `inference set`
consumer running against OpenShell 0.0.85. A global missing-provider
parser would be unsafe because route-update output may identify a
different provider; exact-name lookup and product-level route tests
protect the scoped behavior.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Codex Desktop
exact-head review at `2c31c1a99` passed all nine categories with no
findings; endpoint SSRF validation, exact-name provider parsing,
host-only credential handling, provider ownership verification, rollback
behavior, and mutation locking remain intact, and the final
test-timeout-only commit changes no production path
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: `docs/inference/switch-providers.mdx`; verified
pre-selection provider creation and verification, correlated one-time
retry, created-provider rollback, existing-provider update ordering,
DNS-backed HTTPS ordering, generated agent variants, and writing rules
at exact head `2c31c1a99`. The docs build passed with 0 errors and 2
pre-existing warnings; the automatic main merge preserved the reviewed
behavior, the empty E2E-retrigger commit is tree-identical to that
reviewed head, the post-merge inference suite passed 177/177, and the
timeout-only follow-up changed no user-facing contract, its file passed
33/33, and the affected test passed three consecutive focused runs.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 2c31c1a99 -->
<!-- docs-review-agents-blob-sha: be20a0952 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: Not applicable
- Station profile/scenario: Not applicable
- Result: Not applicable
- Supporting evidence: Not applicable

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — focused inference suite before the
main sync: 86 passed; `npm run test:changed`: 169 passed; post-merge
inference suite: 177 passed; workflow-boundary file: 33 passed; exact
affected test: 3 consecutive focused passes; `npm run typecheck:cli`,
repository checks, source-shape checks, and test-condition scan passed
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — not applicable to this scoped inference
fix and timeout-budget correction
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — passed
with 0 errors and 2 pre-existing warnings
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Improved compatible inference provider switching, including
registering and validating compatible custom endpoints using complete
route metadata.
* Enhanced inference-set provider binding to support direct provider
flows alongside HTTPS-pin flows.
* **Documentation**
* Updated the “Switch Inference Providers” guide with revised onboarding
and clearer “provider not found” behavior and compatible-endpoint
requirements.
* **Bug Fixes**
* Improved retry and rollback behavior when provider lookup reports a
miss, preserving inference selection.
* Ensures the correct canonical credential environment is exported
during shields-down compatible-endpoint flows.
* **Tests**
* Expanded coverage for compatible provider create/update and added
environment-stub cleanup across tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>