feat: complete Hawk/Eyrie engine boundary

[Patel230]

Summary

• complete the Hawk product-face / Eyrie provider-engine boundary and remove Hawk’s duplicate provider routing layer
• route catalog, selection, credentials, generation, streaming, provider resilience, and route attribution through eyrie/engine
• preserve Hawk ownership of the agent loop, tools, sessions, durable daemon state, product schemas, and user-facing configuration
• add durable daemon-session/readiness behavior, route-aware usage/cost attribution, and boundary/regression coverage
• pin both Hawk’s gitlink and public module graph to Eyrie v0.2.1 (2e5ec4e)
• strengthen Docker/security gates and record the final ecosystem verification evidence

Release alignment

• Eyrie v0.2.0 established the engine and adapter boundary
• consumer verification found an explicit-provider override bug
• Eyrie v0.2.1 fixes that regression and passed its complete hosted CI/release matrix
• scripts/check-submodule-release-parity.sh reports all seven ecosystem modules OK

Verification

• two complete shuffled Hawk test passes with the workspace submodules
• two complete shuffled Hawk test passes with GOWORK=off
• exact workspace race/atomic-coverage gate: 69.0% statements
• public-module readonly build of ./cmd/hawk
• go vet ./...
• golangci-lint run ./... --timeout=5m (0 issues)
• gofumpt and goimports clean
• all six architecture/import/coupling guards
• workspace and GOWORK=off govulncheck: no reachable vulnerabilities
• module tidy, workspace sync, checksum verification, and Eyrie source/module parity

Published dependency

• Eyrie v0.2.1: https://github.com/GrayCodeAI/eyrie/releases/tag/v0.2.1