Preserve saved endpoints during provider preflight

[Brian Krabach (bkrabach)]

Provider metadata discovery discarded saved endpoints, so vLLM's public constructor failed before Unified could materialize any provider. Pass the exact configured instance's endpoint to constructors that declare base_url, while keeping metadata config empty and excluding saved API/token fields. Model-list/test probes receive the same materialized endpoint.

Bundle preflight now collects allowlisted module/instance failures and commits root/nested provider changes only after every instance passes. Failed preflight leaves priorities, role preferences, accounts, and both plans unchanged. Errors identify schema versus configuration failure without raw exceptions or configuration values; feedback retains reason counts without account identities.

Partially addresses #182. Missing required credentials on an enabled provider still stop preparation. Full per-provider isolation needs a supported per-instance mount outcome plus routing rules that propagate unavailable-provider failures instead of silently selecting another account. The concrete boundaries are documented in docs/validation/provider-preflight.md; this PR introduces no loader patches, placeholders, or changed fallback policy.

Validation: the credential-free before/after reproduction failed when the saved endpoint was discarded and passed with the exact endpoint after this change, without network/model calls. 186 focused Python checks passed, including isolated probe subprocesses, setup, provider selection/lifecycle, host resume, bundle/shared-runtime preparation, and diagnostics; the updated feedback diagnostics suite also passed 9/9. Tests cover distinct account endpoints, missing endpoints/secrets, nested atomicity, cancellation, and sanitized errors. No Spark access, live provider request, CLI installation, merge, or publication was performed.