fix(core): resolve undefined symbols hidden by lib_provisioning star-imports

Six symbols were referenced across the codebase but had no definition anywhere.
Star-imports from lib_provisioning/mod.nu silenced the missing-def errors at
parse time; at runtime the call sites either threw or took dead code paths.
ADR-025 Phase 2 (AST audit) surfaced them as blockers for Phase 3 because
selective imports would expose them as "variable not found" errors.

Resolution: add stub getters in lib_provisioning/config/accessor/functions.nu
following the existing pattern (env -> config -> PROVISIONING-derived -> ""):

  - get-providers-path          (14 call sites)
  - get-prov-lib-path           (2 call sites)
  - get-core-nulib-path         (7 call sites)
  - get-provisioning-generate-dirpath  (5 call sites)
  - get-provisioning-generate-defsfile (1 call site)
  - get-provisioning-req-versions (4 call sites)

All existing callers already guard results with is-empty / path exists checks,
so empty-string returns fall back to safe no-op paths.

show_tools_info (main_provisioning/tools.nu) was missing a guard around its
open call; added is-empty / path-exists check matching sibling fns.

The only non-path symbol (on_clusters in clusters/create.nu) had no recoverable
implementation; its closure is replaced with a user-facing message directing
to 'prvng cluster deploy' (the supported workflow).

Refs: ADR-025, .coder/benchmarks/phase2-findings.md blockers section

nulib/clusters/create.nu

@@ -54,10 +54,10 @@ export def "main create" [
     let other = if ($args | length) > 0 { ($args| skip 1) } else { "" }
     let ops = $"($env.PROVISIONING_ARGS? | default "") " | str replace $"($task) " "" | str trim
     let run_create = {
-        let curr_settings = (find_get_settings --infra $infra --settings $settings)
-        $env.WK_CNPROV = $curr_settings.wk_path
-        let match_name = if $name == null or $name == "" { "" } else { $name}
-        on_clusters $curr_settings $check $wait $outfile $match_name $cluster_pos
+        # on_clusters is not defined anywhere in the codebase; cluster-create via
+        # this entrypoint was dead at runtime. The workflow now lives in
+        # main_provisioning/cluster-deploy.nu (prvng cluster deploy).
+        _print $"(_ansi yellow)cluster create via this command is not wired(_ansi reset) — use 'prvng cluster deploy <layer> <cluster>' instead."
     }
     match $task {
         "" if $name == "h" => {

nulib/lib_provisioning/config/accessor/functions.nu

@@ -75,3 +75,58 @@ export def get-provisioning-vars [] : nothing -> string {
 export def get-provisioning-wk-env-path [] : nothing -> string {
     $env.PROVISIONING_WK_ENV_PATH? | default ""
 }
+
+# Path to the extensions/providers/ tree. Resolution order:
+# PROVISIONING_PROVIDERS_PATH env → paths.providers config → PROVISIONING/extensions/providers → "".
+# Empty result means "no providers available"; callers must guard with `| is-empty` or `| path exists`.
+export def get-providers-path [] : nothing -> string {
+    let from_env = ($env.PROVISIONING_PROVIDERS_PATH? | default "")
+    if ($from_env | is-not-empty) and ($from_env | path exists) { return $from_env }
+    let configured = (config-get "paths.providers" "")
+    if ($configured | is-not-empty) and ($configured | path exists) { return $configured }
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-not-empty) {
+        let derived = ($prov | path join "extensions" | path join "providers")
+        if ($derived | path exists) { return $derived }
+    }
+    ""
+}
+
+# Path to the shared provider library (extensions/providers/prov_lib/).
+export def get-prov-lib-path [] : nothing -> string {
+    let providers = (get-providers-path)
+    if ($providers | is-empty) { return "" }
+    $providers | path join "prov_lib"
+}
+
+# Path to provisioning/core/nulib/ from the PROVISIONING root.
+export def get-core-nulib-path [] : nothing -> string {
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-empty) { return "" }
+    $prov | path join "core" | path join "nulib"
+}
+
+# Directory name where per-provider generated defs live (relative to a provider dir).
+export def get-provisioning-generate-dirpath [] : nothing -> string {
+    $env.PROVISIONING_GENERATE_DIRPATH? | default "generate"
+}
+
+# Filename for per-provider generated defs inside get-provisioning-generate-dirpath.
+export def get-provisioning-generate-defsfile [] : nothing -> string {
+    $env.PROVISIONING_GENERATE_DEFSFILE? | default "defs.ncl"
+}
+
+# Path to the tools required-versions file (nickel/yaml declaring required tool versions).
+# Resolution: PROVISIONING_REQ_VERSIONS env → paths.req_versions config → PROVISIONING/resources/tools.yaml → "".
+export def get-provisioning-req-versions [] : nothing -> string {
+    let from_env = ($env.PROVISIONING_REQ_VERSIONS? | default "")
+    if ($from_env | is-not-empty) and ($from_env | path exists) { return $from_env }
+    let configured = (config-get "paths.req_versions" "")
+    if ($configured | is-not-empty) and ($configured | path exists) { return $configured }
+    let prov = ($env.PROVISIONING? | default "")
+    if ($prov | is-not-empty) {
+        let derived = ($prov | path join "resources" | path join "tools.yaml")
+        if ($derived | path exists) { return $derived }
+    }
+    ""
+}

nulib/main_provisioning/tools.nu

@@ -227,7 +227,12 @@ export def "main tools" [
 export def show_tools_info [
   match: string
 ] {
-  let tools_data = (open (get-provisioning-req-versions))
+  let req_versions = (get-provisioning-req-versions)
+  if ($req_versions | is-empty) or (not ($req_versions | path exists)) {
+    _print $"(_ansi yellow)Tools registry not available(_ansi reset) — set PROVISIONING_REQ_VERSIONS or paths.req_versions."
+    return
+  }
+  let tools_data = (open $req_versions)
   if ($match | is-empty) {
     _print ($tools_data | table -e)
   } else {