Formalize cllama ingress surfaces and centralize runner protocol mapping

[mostlydev]

Summary

• add a shared cllama ingress-surface contract in internal/cllama
• refactor OpenClaw to compile through the shared cllama surface contract instead of a private provider switch
• reject reserved synthetic ingress provider prefixes such as cllama/google during cllama config compilation
• make OpenClaw's ingress-surface adapter fail closed on unknown canonical surfaces
• update the cllama spec and ADRs to document the explicit ingress surface matrix and confirmed driver scope

Why

Issue #134 identified that provider identity and runner transport had drifted together in OpenClaw's local config logic. This PR makes the runner-to-cllama protocol an explicit infrastructure-owned contract instead of a driver-local convention.

Scope confirmation: only OpenClaw needed an immediate integration change after the contract was centralized. The other in-tree drivers do not currently compile provider identity into runner-specific API-surface enums; they only rewrite base URLs, API keys, or generic custom-provider fields when cllama is enabled.

Testing

• go test ./...
• go vet ./...

Closes #134