refactor(23 files): selective imports + dangling/broken cleanup (ADR-025 L2/L3)

Large combined batch of 23 files refactored from star-imports to selective.
Grouped because two sub-batches accumulated in staging without intermediate
commit.

=== Orchestrator facades (Layer 3) ===
  ai/mod.nu              [12 symbols from ai/lib.nu]
  config/loader.nu       [14 symbols from loader/mod.nu]
  config/accessor/mod.nu [15 symbols from accessor/functions.nu]
  sops/mod.nu            [11 symbols from sops/lib.nu]
  user/mod.nu            [16 symbols from user/config.nu]

=== Selective imports ===
  defs/lists.nu                      utils/on_select (kept, selective)
  services/manager.nu                (all dead dropped)
  webhook/ai_webhook.nu              ai/lib [4] + settings/lib
  kms/lib.nu                         utils/error + utils/interface + plugins/kms
  gitea/locking.nu                   api_client [8]
  gitea/workspace_git.nu             api_client [3]
  gitea/extension_publish.nu         api_client [8] + config/loader
  infra_validator/rules_engine.nu    config_loader [3]
  plugins/kms.nu                     config/accessor/core [config-get]
  coredns/api_client.nu              config/loader [get-config]

=== Dangling imports removed (target file does not exist) ===
  coredns/docker.nu                  ../utils/log.nu → deleted (uses corefile.nu [2])
  coredns/zones.nu                   ../utils/log.nu → deleted (uses corefile.nu [1])
  coredns/service.nu                 ../utils/log.nu → deleted (uses corefile.nu [2])
  coredns/corefile.nu                ../utils/log.nu → deleted

=== Broken paths cleaned up ===
  project/detect.nu   Former `use ../../../lib_provisioning *` resolved to
    non-existent path (core/lib_provisioning). Silent no-op at runtime.
    Removed. Error count went 19 -> 17.

=== Dead imports dropped ===
  utils/ssh.nu           config/accessor DROPPED (dead)
  utils/init.nu          config/accessor DROPPED (dead)
  infra_validator/agent_interface.nu   report_generator DROPPED (dead)

=== Dynamic imports preserved ===
  providers/loader.nu   line 179 `use ($provider_entry.entry_point) *` is
    intentional runtime dispatch — not convertible to selective.

Validation: all files match pre-existing baseline. Gitea subsystem has
known pre-existing 50-error noise (transitive); independent of this work.

Refs: ADR-025

nulib/lib_provisioning/ai/mod.nu

@@ -1 +1,6 @@
-export use lib.nu *
+# ai/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [
+    get_ai_config is_ai_enabled get_provider_config build_headers build_endpoint
+    ai_request ai_complete ai_generate_template ai_process_query
+    ai_process_webhook validate_ai_config test_ai_connection
+]

nulib/lib_provisioning/config/accessor/mod.nu

@@ -57,5 +57,12 @@ export def get-full-config []: nothing -> record {
     load-deployment-mode
 }
 
-# Import specific functions only
-export use ./functions.nu *
+# Selective re-export (ADR-025 Phase 3 Layer 3).
+export use ./functions.nu [
+    get-provisioning-url get-components-path get-taskservs-path
+    get-run-taskservs-path get-provisioning-wk-format get-use-nickel
+    get-keys-path get-provisioning-vars get-provisioning-wk-env-path
+    get-providers-path get-prov-lib-path get-core-nulib-path
+    get-provisioning-generate-dirpath get-provisioning-generate-defsfile
+    get-provisioning-req-versions
+]

nulib/lib_provisioning/config/loader.nu

@@ -1,4 +1,13 @@
 # Configuration Loader Orchestrator (v2)
 # Re-exports modular loader components using folder structure
 
-export use ./loader/mod.nu *
+# Config Loader orchestrator (ADR-025 Phase 3 Layer 3).
+# Re-exports the selective symbol set that loader/mod.nu declares.
+# loader/mod.nu is already selective (14 symbols across 5 files).
+export use ./loader/mod.nu [
+    load-provisioning-config validate-config validate-config-structure
+    validate-data-types validate-file-existence validate-path-values
+    validate-semantic-rules apply-environment-variable-overrides
+    detect-current-environment get-available-environments validate-environment
+    create-interpolation-test-suite test-interpolation get-dag-config
+]

nulib/lib_provisioning/coredns/api_client.nu

@@ -1,8 +1,8 @@
 # CoreDNS API Client
 # Client for orchestrator DNS API endpoints
 
-use ../utils/log.nu *
-use ../config/loader.nu get-config
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/config/loader.nu [get-config]
 
 # Call orchestrator DNS API
 export def call-dns-api [

nulib/lib_provisioning/coredns/corefile.nu

@@ -1,7 +1,7 @@
 # CoreDNS Corefile Generator
 # Generates and manages Corefile configuration for CoreDNS
 
-use ../utils/log.nu *
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
 
 # Generate Corefile from configuration
 export def generate-corefile [

nulib/lib_provisioning/coredns/docker.nu

@@ -1,8 +1,8 @@
 # CoreDNS Docker Management
 # Manage CoreDNS in Docker containers using docker-compose
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS Docker container

nulib/lib_provisioning/coredns/service.nu

@@ -1,8 +1,8 @@
 # CoreDNS Service Manager
 # Start, stop, and manage CoreDNS service
 
-use ../utils/log.nu *
-use corefile.nu [generate-corefile write-corefile]
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-corefile write-corefile]
 use zones.nu create-zone-file
 
 # Start CoreDNS service

nulib/lib_provisioning/coredns/zones.nu

@@ -1,8 +1,8 @@
 # CoreDNS Zone File Management
 # Create, update, and manage DNS zone files
 
-use ../utils/log.nu *
-use corefile.nu generate-zone-file
+# ../utils/log.nu does not exist — dangling import removed (ADR-025 L2).
+use lib_provisioning/coredns/corefile.nu [generate-zone-file]
 
 # Create zone file with SOA and NS records
 export def create-zone-file [

nulib/lib_provisioning/defs/lists.nu

@@ -1,6 +1,6 @@
 
-use ../config/accessor.nu *
-use ../utils/on_select.nu run_on_selection
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/on_select.nu [run_on_selection]
 export def get_provisioning_info [
     dir_path: string
     target: string

nulib/lib_provisioning/gitea/extension_publish.nu

@@ -4,8 +4,12 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
-use ../config/loader.nu get-config
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    create-release create-repository get-gitea-config get-gitea-token
+    get-release-by-tag get-repository list-releases upload-release-asset
+]
+use lib_provisioning/config/loader.nu [get-config]
 
 # Validate extension structure
 def validate-extension [

nulib/lib_provisioning/gitea/locking.nu

@@ -4,7 +4,11 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [
+    close-issue create-issue create-repository get-current-user
+    get-gitea-config get-issue get-repository list-issues
+]
 
 # Lock label constants
 const LOCK_LABEL_PREFIX = "workspace-lock"

nulib/lib_provisioning/gitea/workspace_git.nu

@@ -4,7 +4,8 @@
 #
 # Version: 1.0.0
 
-use api_client.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/gitea/api_client.nu [create-repository get-gitea-config get-repository]
 
 # Initialize workspace as git repository
 export def init-workspace-git [

nulib/lib_provisioning/infra_validator/agent_interface.nu

@@ -2,8 +2,9 @@
 # Provides programmatic interface for automated infrastructure validation and fixing
 # Error handling: Guard patterns (no try-catch for field access)
 
-use validator.nu
-use report_generator.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+# report_generator star-import was dead — dropped.
+use lib_provisioning/infra_validator/validator.nu
 
 # Main function for AI agents to validate infrastructure
 export def validate_for_agent [

nulib/lib_provisioning/infra_validator/rules_engine.nu

@@ -2,7 +2,10 @@
 # Defines and manages validation rules for infrastructure configurations
 # Error handling: Guard patterns (no try-catch for field access)
 
-use config_loader.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/infra_validator/config_loader.nu [
+    create_rule_context load_rules_from_config load_validation_config
+]
 
 # Main function to get all validation rules (now config-driven)
 export def get_all_validation_rules [

nulib/lib_provisioning/kms/lib.nu

@@ -1,8 +1,8 @@
 use std
-use ../config/accessor.nu *
-use ../utils/error.nu throw-error
-use ../utils/interface.nu _print
-use ../plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/utils/error.nu [throw-error]
+use lib_provisioning/utils/interface.nu [_print]
+use lib_provisioning/plugins/kms.nu [plugin-kms-encrypt plugin-kms-decrypt plugin-kms-info]
 
 def find_file [
     start_path: string

nulib/lib_provisioning/plugins/kms.nu

@@ -1,7 +1,8 @@
 # KMS Plugin Wrapper with HTTP Fallback
 # Provides graceful degradation to HTTP/CLI when nu_plugin_kms is unavailable
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/config/accessor/core.nu [config-get]
 
 # Check if KMS plugin is available (registered with Nushell)
 def is-plugin-available [] {

nulib/lib_provisioning/project/detect.nu

@@ -1,7 +1,9 @@
 # Provisioning Project Detection Module
 # Provides functions for technology detection and requirement inference
 
-use ../../../lib_provisioning *
+# Former `use ../../../lib_provisioning *` was a broken path (resolves to
+# non-existent core/lib_provisioning) — it was a silent no-op at runtime.
+# Removed per ADR-025 Phase 3 Layer 2.
 
 # Detect technologies in a project
 export def detect-project [

nulib/lib_provisioning/services/manager.nu

@@ -3,7 +3,7 @@
 # Service Manager Core
 # Manages platform service lifecycle, registry, and health checks
 
-use ../config/loader.nu *
+# config/loader star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 def get-service-state-dir [] {
     $"($env.HOME)/.provisioning/services/state"

nulib/lib_provisioning/sops/mod.nu

@@ -1 +1,6 @@
-export use lib.nu *
+# sops/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use lib.nu [
+    run_cmd_sops on_sops generate_sops_file generate_sops_settings edit_sop
+    is_sops_file decode_sops_file get_def_sops get_def_age find-sops-key
+    get-sops-age-key-file
+]

nulib/lib_provisioning/user/mod.nu

@@ -1,2 +1,9 @@
 # User configuration module exports
-export use config.nu *
+# user/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+export use config.nu [
+    get-user-config-path load-user-config create-default-user-config
+    save-user-config get-active-workspace get-active-workspace-details
+    set-active-workspace list-workspaces remove-workspace register-workspace
+    get-user-preference set-user-preference validate-workspace-exists
+    get-workspace-path get-workspace-default-infra set-workspace-default-infra
+]

nulib/lib_provisioning/utils/init.nu

@@ -3,7 +3,7 @@
 # Dependencies: error, interface, config/accessor
 
 
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 # Get the complete provisioning command arguments as a string
 export def get-provisioning-args [] : nothing -> string {

nulib/lib_provisioning/utils/ssh.nu

@@ -1,4 +1,4 @@
-use ../config/accessor.nu *
+# config/accessor star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
 
 export def ssh_cmd  [
   settings: record

nulib/lib_provisioning/webhook/ai_webhook.nu

@@ -2,8 +2,9 @@
 # Provides AI-powered webhook endpoints for chat platforms
 
 use std
-use ../ai/lib.nu *
-use ../settings/lib.nu get_settings
+# Selective imports (ADR-025 Phase 3 Layer 2).
+use lib_provisioning/ai/lib.nu [ai_process_webhook get_ai_config is_ai_enabled test_ai_connection]
+use lib_provisioning/settings/lib.nu [get_settings]
 
 # Main webhook handler for AI-powered chat integration
 export def ai_webhook_handler [