feat(check): global model configuration for MultiTool Checks (file/env/flag)

[RobbieMcKinstry]

Replace the hardcoded checks::config::configuration() with a real
configuration-loading layer that resolves the global default provider,
model, and effort from three sources with standard CLI precedence
(flag > env var > config file), merged with figment, and constructs a
registry of ready-to-use model providers for a future executor.

• New src/checks/config/ module:
  • schema.rs: ProviderKind/Effort enums + the [checks] file schema and
    the CliOverrides flag layer (serde + clap ValueEnum).
  • file.rs: locate/read MultiTool.toml (.json/.jsonc) via the existing
    fs::StaticFile machinery; tolerates legacy manifest keys so one file
    carries both rollout and checks config.
  • models.rs: hardcoded model allowlist + per-provider defaults; used to
    validate the configured model.
  • providers.rs: build one handle per provider whose credential env var is
    present (<=3), dispatching on provider name only (no from_model_string),
    honoring per-provider base_url overrides. Credentials are env-only.
  • mod.rs: figment merge file -> Env::prefixed("MULTI_") -> Serialized::defaults(cli) (flag > env > file), validation, and the
    Resolved { config, providers } handoff.
• CLI: multi check gains --provider/--model/--effort as Option<T>
  with no clap default, so unset flags don't clobber env/file layers.
• Deps: cersei-provider, figment (+ figment[test] dev-dep for Jail).
• Docs: Configuration section in guides/checks.md.

The execution path is out of scope: the provider registry is constructed
and handed off but not yet wired into the executor; ClaudeExecutor still
runs the checks. Retiring run + the legacy Manifest schema (so
MultiTool.toml is no longer consumed by run) is tracked separately as a
blocking follow-up; the two readers coexist for now.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

[RobbieMcKinstry]

• feat(check): global model configuration for MultiTool Checks (file/env/flag) #143 👈 (View in Graphite)
• trunk

This stack of pull requests is managed by Graphite. Learn more about stacking.