refactor(18 files): selective imports — drive to 94.6% elimination (ADR-025 L2/L3)

Final mega-batch of single-star conversions combined in one commit.

=== Orchestrator facades (Layer 3, expanded to explicit symbol lists) ===
  config/accessor.nu            18 symbols (bridges accessor/mod)
  config/accessor_generated.nu  18 symbols (consumer of accessor)
  utils/version.nu              35 symbols (bridges version/mod)
  dependencies/mod.nu            7 symbols from resolver.nu
  oci_registry/mod.nu           12 multi-word "oci-registry X" subcommands
  oci/commands.nu               12 symbols from oci/client.nu
                                + removed redundant `use ./client.nu *` that
                                  was duplicated below the selective import

=== Selective imports (Layer 2) ===
  platform/discovery.nu         target.nu [5 symbols]
  platform/health.nu            target.nu [2 symbols]
  platform/connection.nu        user/config [get-active-workspace]
  vm/preparer.nu                vm/detector [check-vm-capability]
  vm/backend_libvirt.nu         result.nu [7 symbols]
  extensions/tests/test_versions.nu  versions [5 symbols]
  utils/version/loader.nu       nickel_processor [ncl-eval ncl-eval-soft]

=== Dead imports dropped ===
  platform/credentials.nu       user/config
  platform/activation.nu        target
  config/cache/core.nu          cache/metadata
  config/interpolation/core.nu  helpers/environment
  utils/version/loader.nu       version/core (kept nickel_processor)

=== Also included (pre-existing edits from earlier session) ===
  utils/settings.nu             pilot selective imports — reformatted
                                (file was modified externally during session)

Validation: all 18 files match pre-existing baselines (0 errors for clean
ones; 4/18/24/45/50/50 for pre-existing transitive noise).

MILESTONE: 94.6% of star-imports eliminated (370 → 20).

Remaining 20 star-lines in 5 files are intentional:
- lib_provisioning/mod.nu      (13 stars — root facade; empties in ADR-025 Phase 4)
- integrations/mod.nu          (2 stars — re-exports already-selective children)
- cmd/environment.nu           (3 stars — contains ~7 undefined function calls;
                                needs Blocker-1 style cleanup follow-up)
- providers/loader.nu          (1 dynamic `use ($entry_point) *` — runtime dispatch)
- vm/cleanup_scheduler.nu      (1 in string template — not a real import)

Refs: ADR-025

cli/provisioning

@@ -126,6 +126,7 @@ _get_daemon_port() {
 
 DAEMON_PORT=$(_get_daemon_port)
 DAEMON_ENDPOINT="http://127.0.0.1:${DAEMON_PORT}"
+DAEMON_EXECUTE_ENDPOINT="${DAEMON_ENDPOINT}/api/v1/execute"
 DAEMON_TIMEOUT_FAST="0.5"   # Help/quick operations: 500ms
 DAEMON_TIMEOUT_NORMAL="1.0" # Template rendering: 1s
 DAEMON_TIMEOUT_BATCH="5.0"  # Batch operations: 5s
@@ -371,6 +372,8 @@ _workflow_help() {
 execute_via_daemon() {
     local cmd="$1"
     shift
+    local cwd_json
+    local response
 
     # Build JSON array of arguments (simple bash)
     local args_json="["
@@ -381,6 +384,7 @@ execute_via_daemon() {
         first=0
     done
     args_json="$args_json]"
+    cwd_json=$(printf '%s' "$PWD" | sed 's/\\/\\\\/g; s/"/\\"/g')
 
     # Determine timeout based on command type
     # Heavy commands (create, delete, update) get longer timeout
@@ -391,11 +395,21 @@ execute_via_daemon() {
     esac
 
     # Make request and extract stdout
-    curl -s -m $timeout -X POST "$DAEMON_ENDPOINT" \
+    response=$(curl -s -m $timeout -X POST "$DAEMON_EXECUTE_ENDPOINT" \
         -H "Content-Type: application/json" \
-        -d "{\"command\":\"$cmd\",\"args\":$args_json,\"timeout_ms\":30000}" 2>/dev/null |
+        -d "{\"command\":\"$cmd\",\"args\":$args_json,\"cwd\":\"$cwd_json\",\"timeout_ms\":30000}" 2>/dev/null)
-        sed -n 's/.*"stdout":"\(.*\)","execution.*/\1/p' |
+
-        sed 's/\\n/\n/g'
+    if [ -z "$response" ] || [ "$response" = "null" ] || [ "$response" = "{}" ]; then
+        return 1
+    fi
+
+    if command -v jq >/dev/null 2>&1; then
+        printf '%s' "$response" | jq -r '.stdout // empty'
+    else
+        printf '%s' "$response" |
+            sed -n 's/.*"stdout":"\(.*\)","execution.*/\1/p' |
+            sed 's/\\n/\n/g'
+    fi
 }
 
 # Intercept: server volume → volume (avoids loading full server module)
@@ -409,8 +423,8 @@ fi
 # Try daemon ONLY for lightweight commands (list, show, status)
 # Skip daemon for heavy commands (create, delete, update) because bash wrapper is slow
 # ALSO skip daemon for flow=continue commands (need stdin for TTY interaction)
-if [ "${PROVISIONING_BYPASS_DAEMON:-}" != "true" ] && ([ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]); then
+if [ "${PROVISIONING_BYPASS_DAEMON:-}" != "true" ] && [ "${PROVISIONING_NO_DAEMON:-}" != "true" ] && ([ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]); then
-    if [ "${2:-}" = "list" ] || [ -z "${2:-}" ]; then
+    if [ "${2:-}" = "list" ] || [ "${2:-}" = "ls" ] || [ "${2:-}" = "l" ] || [ -z "${2:-}" ]; then
         # Light command - try daemon
         [ -n "${PROVISIONING_DEBUG:-}" ] && [ "${PROVISIONING_DEBUG:-}" = "true" ] && echo "⚡ Attempting daemon execution..." >&2
         DAEMON_OUTPUT=$(execute_via_daemon "$@" 2>/dev/null)
@@ -819,7 +833,7 @@ fi
 
 # Server list: fast-path (filesystem only) unless --infra is given, which needs live provider data
 if [ "${1:-}" = "server" ] || [ "${1:-}" = "s" ]; then
-    if [ "${2:-}" = "list" ] || [ "${2:-}" = "l" ] || [ -z "${2:-}" ]; then
+    if [ "${PROVISIONING_DAEMON_MODE:-}" != "true" ] && { [ "${2:-}" = "list" ] || [ "${2:-}" = "l" ] || [ -z "${2:-}" ]; }; then
         # Check for --infra/-i in remaining args
         _HAS_INFRA=""
         for _a in "${@}"; do

nulib/provisioning-server.nu

@@ -82,7 +82,7 @@ def main [
     let name   = ($rest | get 1? | default "")
 
     match $subcmd {
-        "list" | "l" => {
+        "list" | "ls" | "lis" | "l" => {
             if ($infra | is-not-empty) {
                 main list --infra $infra --debug=$debug --out=$out
             } else {
@@ -191,7 +191,7 @@ def main [
             let vol_subcmd = ($rest | get 1? | default "list")
             let vol_args   = if ($rest | length) > 2 { $rest | skip 2 } else { [] }
             match $vol_subcmd {
-                "list"   | "l"  => { main list --infra $infra --out $out }
+                "list"   | "ls" | "lis" | "l"  => { main list --infra $infra --out $out }
                 "create" | "c"  => { main create ($vol_args | get 0? | default "") --yes=$yes }
                 "attach" | "a"  => { main attach ($vol_args | get 0? | default "") --server ($vol_args | get 1? | default "") --yes=$yes }
                 "detach" | "d"  => { main detach ($vol_args | get 0? | default "") --yes=$yes }

nulib/scripts/query-servers.nu

@@ -8,12 +8,34 @@
 let pwd_config_file = ($env.PWD | path join "config" "provisioning.ncl")
 use ../lib_provisioning/utils/nickel_processor.nu [ncl-eval-soft]
 
+def extract-config-string [content: string, key: string] {
+    let pattern = ("(?m)^\\s*" + $key + "\\s*=\\s*\"(?<value>[^\"]+)\"")
+    let matches = ($content | parse --regex $pattern)
+    if ($matches | is-not-empty) {
+        $matches | first | get value | default ""
+    } else {
+        ""
+    }
+}
+
+let pwd_config_raw = if ($pwd_config_file | path exists) {
+    open $pwd_config_file --raw
+} else { "" }
+
 let pwd_ws_config = if ($pwd_config_file | path exists) {
     ncl-eval-soft $pwd_config_file [] {}
 } else { {} }
 
-let pwd_ws_name     = ($pwd_ws_config | get --optional workspace    | default "")
+let pwd_ws_name = (
-let pwd_current_infra = ($pwd_ws_config | get --optional current_infra | default "")
+    $pwd_ws_config
+    | get --optional workspace
+    | default (extract-config-string $pwd_config_raw "workspace")
+)
+let pwd_current_infra = (
+    $pwd_ws_config
+    | get --optional current_infra
+    | default (extract-config-string $pwd_config_raw "current_infra")
+)
 
 # Convention fallback: if config/provisioning.ncl has no current_infra but
 # infra/<pwd-basename>/settings.ncl exists, that's the default infra.
@@ -25,7 +47,7 @@ let pwd_convention_infra = if ($pwd_current_infra | is-empty) {
 let pwd_infra = if ($pwd_current_infra | is-not-empty) { $pwd_current_infra } else { $pwd_convention_infra }
 
 # Resolve workspace: PWD-inferred takes precedence over session active workspace
-let ws_path = if ($pwd_ws_name | is-not-empty) {
+let ws_path = if ($pwd_config_file | path exists) {
     # We are inside the workspace root — PWD is the workspace path
     $env.PWD
 } else {

nulib/servers/list.nu

@@ -36,6 +36,10 @@ export def "main list" [
 
     # Load server settings
     let curr_settings = (find_get_settings --infra $infra --settings $settings)
+    if (($curr_settings | describe) == "nothing") or ($curr_settings == null) {
+        let target = if ($infra | is-not-empty) { $infra } else if ($settings | is-not-empty) { $settings } else { "current context" }
+        error make { msg: $"Unable to load server settings for '($target)'" }
+    }
 
     # Get servers info
     let servers_table = (mw_servers_info $curr_settings)