fix(server): warn on dangling provider refs at startup

[ericcurtin]

Summary

A deleted provider no longer blocks gateway startup. The preflight warns and keeps validating.

Related Issue

Closes #4657

Changes

• Preflight loads providers concurrently and warns per sandbox on missing ones.
• Strict and lenient loaders share one concurrent lookup.
• The global policy delete in UpdateConfig uses the same check, so it also tolerates a dangling reference.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Ran cargo clippy and the openshell-server grpc:: unit tests, including new dangling reference cases for startup and global policy delete.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@johntmyers @elezar PTAL, and /ok to test 1ed3a28e09724eae20ff8ed886ff1cf641858ef3 if it looks good. Thank you!

[ericcurtin]

Merged main to fix conflicts. @johntmyers @elezar PTAL, and /ok to test 30c1f3b952de6bc334f529ed0338470e4daff6da if it looks good. Thank you!

[mavromixaliskoullis-beep]

Is ok

[mrunalp]

/ok to test 30c1f3b

[github-actions]

Label test:e2e applied, but pull-request/4661 does not exist yet. A maintainer needs to comment /ok to test 30c1f3b952de6bc334f529ed0338470e4daff6da to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[ericcurtin]

E2E failures look unrelated to this change: k3s-ha pod gating timeout, ssh_host_identity container exit, and workspace operator lbl-sb1 already exists. Could a maintainer re-run the failed jobs? Thank you!

[EmilienM]

Approved. This does what #4657 asks: a missing provider gets one warning per sandbox, and store errors and the #2962 invalid-composition guard stay fatal. I left three small comments, none blocking: test ordering, the sequential lookups, and the UpdateConfig path that shares this helper. Heads up that my approval doesn't count toward required reviews, so you'll still need a maintainer's.

[ericcurtin]

Addressed review feedback. @johntmyers @elezar PTAL, and /ok to test 8c3231e65e79d68c5d1771ec7d9afee3dfe2098c if it looks good. Thank you!

[mrunalp]

/ok to test 8c3231e