refactor(providers/extensions/plugins): selective imports batch (ADR-025 L2/L3)

Three unrelated files grouped in one commit because each is a mechanical
3-5 star -> selective conversion with small cleanups.

providers/loader.nu (L2):
  registry.nu  [4 symbols]
  logging.nu   [2 symbols]
  interface.nu DROPPED (dead)
  Note: dynamic `use ($provider_entry.entry_point) *` at line ~173 is
  intentional runtime dispatch; not convertible.

extensions/loader_oci.nu (L2):
  logging.nu     [3 symbols]
  oci/client.nu  [7 symbols]
  loader.nu      [4 symbols] — fixed comma-separated list syntax quirk
  config/accessor  DROPPED (dead)
  extensions/cache DROPPED (dead)

plugins/mod.nu (L3 facade):
  auth.nu          [1 symbol]
  kms.nu           [8 symbols]
  secretumvault.nu [9 symbols]
  config/accessor  DROPPED (dead)
  + added `use utils/interface.nu [_ansi]` — _ansi was used in body but
    previously arrived through implicit star chain; now explicit.

Validation: all three nu --ide-check 50 -> 0 errors.

Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md

nulib/lib_provisioning/extensions/loader_oci.nu

@@ -1,11 +1,14 @@
 # OCI-Aware Extension Loader
 # Loads extensions from multiple sources: OCI, Gitea, Local
 
-use ../config/accessor.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
-use ../utils/logging.nu *
+# config/accessor and extensions/cache star-imports were dead — dropped.
-use ../oci/client.nu *
+use lib_provisioning/utils/logging.nu [log-debug log-error log-info]
-use cache.nu *
+use lib_provisioning/oci/client.nu [
-use loader.nu [load-manifest, is-extension-allowed, check-requirements, load-hooks]
+    get-oci-config is-oci-available load-oci-token oci-artifact-exists
+    oci-get-artifact-manifest oci-get-artifact-tags oci-pull-artifact
+]
+use lib_provisioning/extensions/loader.nu [load-manifest is-extension-allowed check-requirements load-hooks]
 
 # Check if extension is already loaded (in memory)
 def is-loaded [extension_type: string, extension_name: string] {

nulib/lib_provisioning/plugins/mod.nu

@@ -5,12 +5,24 @@
 # Plugin Wrapper Modules
 # Exports all plugin wrappers with HTTP fallback support
 
-export use auth.nu *
+# plugins/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
-export use kms.nu *
-export use secretumvault.nu *
 
-# Plugin management utilities
+export use auth.nu [plugin-auth-status]
-use ../config/accessor.nu *
+export use kms.nu [
+    plugin-kms-backends plugin-kms-decrypt plugin-kms-encrypt
+    plugin-kms-generate-key plugin-kms-info plugin-kms-list-keys
+    plugin-kms-rotate-key plugin-kms-status
+]
+export use secretumvault.nu [
+    decrypt-config-file encrypt-config-file plugin-secretumvault-decrypt
+    plugin-secretumvault-encrypt plugin-secretumvault-generate-key
+    plugin-secretumvault-health plugin-secretumvault-info
+    plugin-secretumvault-rotate-key plugin-secretumvault-version
+]
+
+# config/accessor star-import was dead (no accessor symbols used in body) —
+# dropped. Add _ansi explicitly — previously came through an implicit chain.
+use lib_provisioning/utils/interface.nu [_ansi]
 
 # List all available plugins with status
 export def list-plugins [] {

nulib/lib_provisioning/providers/loader.nu

@@ -1,9 +1,15 @@
 # Provider Loader System
 # Dynamic provider loading and interface validation
 
-use registry.nu *
+# Selective imports (ADR-025 Phase 3 Layer 2).
-use interface.nu *
+# providers/interface.nu was a dead star-import — dropped.
-use ../utils/logging.nu *
+# Note: dynamic `use ($provider_entry.entry_point) *` remains at line ~173
+# (runtime load of the selected provider's module). Not convertible to
+# selective; that's intentional dynamic dispatch.
+use lib_provisioning/providers/registry.nu [
+    get-provider-entry get-provider-stats is-provider-available list-providers
+]
+use lib_provisioning/utils/logging.nu [log-debug log-error]
 
 # Load provider dynamically with validation (cached)
 export def load-provider [name: string] {