refactor(outbox): nine-method Provider port and LiveProvider composite (476.A)

[rianjs]

Closes #476 — steps 1+2 (Track A) of the approved recommendation from the design record. Track B (LLM adapter extraction) landed as #499, so this PR completes the issue.

Step 1 — narrow outbox

outbox.Provider is a consumer-owned port declaring exactly the nine methods outbox uses: ListInlineThreads, ListReviews, ListIssueComments, PostInlineComment, ReplyToThread, ResolveThread, PostIssueComment, SubmitReview, Capabilities. No atomic CommentWriter/ReviewReader-style capability interfaces, per the design record.

Step 2 — narrow the live orchestration boundary

outbox.LiveProvider embeds the port plus GetPR (ten methods) and is now the boundary for gateio, reviewrun, and threadrespond — one composite, not three structurally identical copies.

Proof obligations from the design record

• Compile-time assertions: gitprovider.Fake and a minimal fake in outbox tests, the GitHub client in its own tests, and app's runtimeProvider.
• A minimal port-only fake drives a real rollup post, proving the unrelated identity/diff/file methods are unnecessary to outbox.
• The existing credential-routing test passes unchanged: reads use the repository provider; capabilities and writes use the posting provider.
• Track A stops here — no per-method capability interfaces, gitprovider.Fake untouched.

Verification

Zero tests deleted. go build, go vet, full go test ./... green unsandboxed (60 packages), repo-wide golangci-lint 0 issues, architecture harness pass. +92/−10 across 7 files.

The full #476 arc

• refactor(llm): extract concrete adapters into internal/llmadapters (476.B) #499 — Track B: concrete LLM adapters extracted into internal/llmadapters
• this PR — Track A: nine-method outbox.Provider + LiveProvider composite