feat(lattice): add provider fallback foundation

[mgazza]

Summary

• add provider-qualified target/path identities with fail-closed alias collision detection
• add per-target/path health TTL and cooldown projection with deterministic gateway-local then vendor-cloud ranking
• add strict APPLIED / NOT_APPLIED / UNKNOWN executor truth and serial fallback only after explicit fallback-safe NOT_APPLIED

Safety boundary

This is stacked on #4382. The module is new, unregistered, and absent from production imports/flows. Its gate defaults off before clock, alias, request, health, or executor access. It has no network, filesystem, MQTT, Home Assistant, inverter, or live control wiring. UNKNOWN, unsafe NOT_APPLIED, invalid returns, health failures, and exceptions stop the chain; task cancellation propagates without mutating health.

Verification

• independent review: APPROVE after cancellation correction
• Python 3.9 focused: 39/39 passed
• Python 3.14 focused: 39/39 plus 183 subtests passed
• wider Lattice suite: 387 tests passed on each runtime; the pre-existing protocol test is environment-blocked by missing/mismatched protobuf runtime
• GitNexus staged detection: LOW, 139 symbols, 2 files, 0 production flows

Tracks Predictive-Cloud-Ltd/predbat-saas-infra#466 and #558.