#3773 fix(daemon): refuse leases for providers without a registered runtime

Summary

leases.allocate with a leaseProvider that no registered runtime claims now fails before any lease is recorded: UNSUPPORTED_OPERATION, details.reason: 'provider-not-registered', details.provider, details.registeredProviders. Previously only the hard-coded required list was checked, so a plugin provider such as testmu on a daemon without the plugin recorded a lease with no device behind it.

• leaseProviderRequiringRuntime in packages/contracts/src/lease-scope.ts is the one classifier. Provider-less leases (including backend-only), proxy and cloud (new CLOUD_LEASE_PROVIDER, used by cloud-profile.ts) need no runtime; every other id must be registered.
• The admission site no longer compares provider names. The now-unread providerRuntimeRequiredIds plumbing is removed from the lease handler, request chain and router. The list itself and createProviderDeviceRuntimeRequestProviders are left for #3767.
• Heartbeat and release are unchanged. Help, plugins.md and client-api.md name the reason.
• 19 files; tests that allocated provider leases without registering the runtime now register it.

Closes #3748. Part of #3747.

Validation

pnpm check:affected --run --head 9923eec046: all runnable checks passed (exactCommit=true). Provider integration suite: 65 files pass, including a testmu refusal with no lease in the registry. Unit tests cover each exemption (provider-less, backend-only, proxy, cloud). Not device-facing.

🤖 Generated with Claude Code