refactor(5 subsystem mod.nu facades): selective re-exports (ADR-025 L3)

Batch of 5+1 facades converted from star re-exports to explicit symbol lists.

defs/mod.nu:
  about.nu [about_info]
  lists.nu [6 symbols]

integrations/mod.nu:
  ecosystem * (already selective — its re-exports are bounded)
  iac *       (fixed in same commit)

integrations/iac/mod.nu  (bonus fix):
  Former `use iac_orchestrator *` was TWO bugs: (1) missing `./` prefix made
  the import path ambiguous, (2) plain `use` vs `export use` meant the facade
  never actually re-exported anything. Converted to
  `export use ./iac_orchestrator.nu [5 symbols]`.
  Side-effect: nu --ide-check errors went 2 -> 4 because iac_orchestrator.nu
  now actually loads and its pre-existing bugs become visible. Not a
  regression — bugs were hidden, now surfaced.

kms/mod.nu:
  lib.nu    [5 symbols]
  client.nu [6 symbols including multi-word "main"]

mode/mod.nu:
  commands.nu [8 multi-word "mode X"]
  validator.nu [2 symbols]

oci/mod.nu:
  client.nu   [12 symbols]
  commands.nu [11 multi-word "oci X"]

Validation: errors match baseline for all 5 (defs, integrations, kms, mode,
oci). integrations/iac/mod.nu +2 errors are pre-existing bugs in
iac_orchestrator.nu revealed by correct facade behaviour.

Refs: ADR-025

nulib/lib_provisioning/defs/mod.nu

@@ -1,3 +1,7 @@
-export use about.nu *
-export use lists.nu *
+# defs/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use about.nu [about_info]
+export use lists.nu [
+    cluster_list get_provisioning_info infras_list on_list
+    providers_list taskservs_list
+]
 # export use settings.nu *

nulib/lib_provisioning/integrations/iac/mod.nu

@@ -1,4 +1,10 @@
 # IaC Orchestrator Integration Module
 # Provides Infrastructure-from-Code to orchestrator conversion utilities
 
-use iac_orchestrator *
+# iac/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# Former `use iac_orchestrator *` was broken (missing `./` prefix and plain use
+# instead of export use — facade wasn't actually re-exporting).
+export use ./iac_orchestrator.nu [
+    iac-to-workflow export-workflow-nickel submit-to-orchestrator
+    monitor-workflow orchestrate-from-iac
+]

nulib/lib_provisioning/integrations/mod.nu

@@ -3,8 +3,8 @@
 # - Ecosystem: External integrations (backup, runtime, SSH, GitOps, service)
 # - IaC: Infrastructure-from-Code to orchestrator conversion
 
-# Re-export ecosystem integrations
-use ./ecosystem *
-
-# Re-export IaC orchestrator integration
-use ./iac *
+# integrations/ facade — selective re-exports via child facades (ADR-025 L3).
+# Both children (ecosystem/mod.nu, iac/mod.nu) are already selective, so this
+# facade can re-export their full API without multiplying stars.
+export use ./ecosystem *
+export use ./iac *

nulib/lib_provisioning/kms/mod.nu

@@ -1,2 +1,3 @@
-export use lib.nu *
-export use client.nu *
+# kms/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [decode_kms_file get_def_kms_config is_kms_file on_kms run_cmd_kms]
+export use client.nu [kms-decrypt kms-encrypt kms-list-backends kms-status kms-test main]

nulib/lib_provisioning/mode/mod.nu

@@ -1,5 +1,9 @@
 # Mode System Module
 # Execution mode management for provisioning system
 
-export use commands.nu *
-export use validator.nu *
+# mode/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use commands.nu [
+    "mode compare" "mode current" "mode init" "mode list"
+    "mode oci-registry" "mode show" "mode switch" "mode validate"
+]
+export use validator.nu [check-runtime-requirements validate-mode-config]

nulib/lib_provisioning/oci/mod.nu

@@ -2,5 +2,14 @@
 # Unified exports for OCI functionality
 # Version: 1.0.0
 
-export use client.nu *
-export use commands.nu *
+# oci/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use client.nu [
+    build-artifact-ref get-oci-config is-oci-available load-oci-token
+    oci-artifact-exists oci-delete-artifact oci-get-artifact-manifest
+    oci-get-artifact-tags oci-list-artifacts oci-pull-artifact
+    oci-push-artifact test-oci-connection
+]
+export use commands.nu [
+    "oci config" "oci copy" "oci delete" "oci inspect" "oci list"
+    "oci login" "oci logout" "oci pull" "oci push" "oci search" "oci tags"
+]