feat: v0.7.0 — am run/start --provider/--model : résolution cloud via le registre (base_url + keyring + modèle), fallback cloud quand le modèle local est inconnu, canal model_env/model_arg/env_map, jamais de token en clair (closes #92)

- apply_provider : providers::resolve_for (flag > agent > défaut) + apply_env_map_resolved (api_key = @secret, base_url/model du provider résolu)
- start/run/restart : --provider et --model dans le CLI, le REPL et la complétion ; specs help + man pages
- Tests unitaires : résolution, cascade, canal déclaré, erreur provider inconnu (liste), absence de fuite (env sans valeur sk-), fallback embarqué

src/cli.rs

@@ -495,6 +495,9 @@ pub enum Command {
         /// Local model to use for this run (validated against the local runtimes)
         #[arg(long, value_name = "MODEL")]
         model: Option<String>,
+        /// Provider to use for this run (issue #92): registry lookup, base_url + keyring token + model
+        #[arg(long, value_name = "PROVIDER")]
+        provider: Option<String>,
         /// Run the agent inside a container (issue #58)
         #[arg(long)]
         container: bool,
@@ -566,6 +569,9 @@ pub struct StartArgs {
     /// Local model to use for this run (validated against the local runtimes)
     #[arg(long, value_name = "MODEL")]
     pub model: Option<String>,
+    /// Provider to use for this run (issue #92): registry lookup, base_url + keyring token + model
+    #[arg(long, value_name = "PROVIDER")]
+    pub provider: Option<String>,
     /// Start every member of a group simultaneously (issue #57)
     #[arg(long, action = ArgAction::SetTrue)]
     pub parallel: bool,