refactor(lib_provisioning/utils/settings): selective imports (ADR-025 pilot)

First real star-import removal. settings.nu is the highest fan-in importer
in the lib_provisioning/ transitivity DAG (8 star-imports, common ancestor
for most symbols consumed by the 16 root fat-import files).

Before:
  use ../config/accessor.nu *
  use ./logging.nu *
  use ./nickel_processor.nu *
  use ./error.nu [throw-error]
  use ./init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources]
  use ../../../../extensions/providers/prov_lib/middleware.nu *
  use ../context.nu *
  use ../sops/mod.nu *
  use ../workspace/detection.nu *
  use ../user/config.nu *

After (absolute paths from nulib/ root, named-symbol imports):
  use lib_provisioning/config/accessor/core.nu [config-get]
  use lib_provisioning/context.nu [setup_user_context]
  use lib_provisioning/sops/lib.nu [is_sops_file decode_sops_file on_sops]
  use lib_provisioning/user/config.nu [get-workspace-default-infra get-workspace-path]
  use lib_provisioning/utils/error.nu [throw-error]
  use lib_provisioning/utils/init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources get-work-format]
  use lib_provisioning/utils/interface.nu [_ansi _print]
  use lib_provisioning/utils/logging.nu [is-debug-enabled]
  use lib_provisioning/utils/nickel_processor.nu [ncl-eval ncl-eval-soft process_nickel_export_raw]
  use lib_provisioning/workspace/detection.nu [detect-infra-from-pwd get-effective-workspace infer-workspace-from-pwd]
  use ../../../../extensions/providers/prov_lib/middleware.nu [mw_create_cache mw_ip_from_cache]

Cross-tree middleware import kept relative — the target is outside nulib/
(public extension API consumed by workspaces). Only two specific middleware
symbols are pulled; the rest of middleware.nu is no longer in settings.nu
scope.

Method: grep bare identifiers in settings.nu body, intersect with each
star-imported target's export set, record origin. Followed pattern from
Phase 3 pilot methodology (ADR-025 section "Fix call sites bottom-up").

Validation:
  nu --ide-check 50 lib_provisioning/utils/settings.nu
  -> 0 errors, 0 warnings (type hints only)

Transitivity note: several target files (error.nu, logging.nu, init.nu,
sops/lib.nu, detection.nu) still contain star-imports of their own. This
pilot proves the pattern works; subsequent commits will climb the DAG
leaves-first and eventually remove those remaining stars.

Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md (Layer 3 priority)

nulib/lib_provisioning/utils/settings.nu

@@ -8,21 +8,27 @@
 #plugin rm "~/.local/bin/nu_plugin_nickel"
 #plugin add "~/.local/bin/nu_plugin_nickel"
 
-use ../config/accessor.nu *
+# Selective imports — absolute paths from nulib/ root (ADR-025 Phase 3 pilot).
-use ./logging.nu *
+# Former star-imports (8) replaced with named-symbol imports to stop the root
-use ./nickel_processor.nu *
+# lib_provisioning/mod.nu chain from propagating the full export graph.
-use ./error.nu [throw-error]
+use lib_provisioning/config/accessor/core.nu [config-get]
-use ./init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources]
+use lib_provisioning/context.nu [setup_user_context]
+use lib_provisioning/sops/lib.nu [is_sops_file decode_sops_file on_sops]
+use lib_provisioning/user/config.nu [get-workspace-default-infra get-workspace-path]
+use lib_provisioning/utils/error.nu [throw-error]
+use lib_provisioning/utils/init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources get-work-format]
+use lib_provisioning/utils/interface.nu [_ansi _print]
+use lib_provisioning/utils/logging.nu [is-debug-enabled]
+use lib_provisioning/utils/nickel_processor.nu [ncl-eval ncl-eval-soft process_nickel_export_raw]
+use lib_provisioning/workspace/detection.nu [detect-infra-from-pwd get-effective-workspace infer-workspace-from-pwd]
+# Cross-tree import (target is outside nulib/): extensions/ is the public API
+# consumed by workspaces. Relative path is unavoidable here.
+use ../../../../extensions/providers/prov_lib/middleware.nu [mw_create_cache mw_ip_from_cache]
 
 # Get default settings filename (Nickel format post-migration)
 def get-default-settings [] : nothing -> string {
     "settings.ncl"
 }
-use ../../../../extensions/providers/prov_lib/middleware.nu *
-use ../context.nu *
-use ../sops/mod.nu *
-use ../workspace/detection.nu *
-use ../user/config.nu *
 
 
 # No-op function for backward compatibility