feat: add native environment provider configuration

[shivros]

Summary

• add native IRIS_ENABLED_PROVIDERS and canonical per-provider environment overlays with env > TOML > defaults precedence
• retain env-backed credentials as references, simplify the container entrypoint to a direct exec, and document file-free deployment
• reject zero IMAP/SMTP ports at startup

Verification

• cargo test --all-targets (178 tests)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check
• env-only Telegram provider smoke test; invalid email port fails fast
• sh -n docker-entrypoint.sh

Closes COD-428

[shivros]

🤖 Automated Review Panel

GPT-5.6-terra

APPROVE — native env overlays preserve TOML/default behavior, retain secret references, fail required provider credentials at construction, and remove entrypoint TOML generation.

---

Gemini 3 Flash

BLOCK → fixed — identified that IRIS_EMAIL_IMAP_PORT=0 / IRIS_EMAIL_SMTP_PORT=0 were accepted. The follow-up commit rejects zero ports in optional_port, adds a constructor regression test covering both keys, and a real env-only CLI smoke test now fails fast with email credentials.imap_port must be at least 1.

Both reviewers found no remaining goal-alignment or security blockers after the fix.

[shivros]

CodeFold Auto-Merge Gate

Confidence: 0.88

Rationale: COD-428 is clearly implemented: native IRIS_* overlays preserve env > TOML > defaults precedence, the container entrypoint no longer materializes configuration, canonical provider env variables are documented, and zero email ports now fail at startup. The linked Linear ticket has no manual-review marker; the existing dual-model panel found the one blocker and its follow-up commit resolves it.

Checks observed: GitHub CI Test, Format Check, Clippy, Secret Scan, Dependency Audit, and Creed context drift are all successful. Local cargo test --all-targets could not complete because the disposable worktree exhausted disk space; this was an environment-capacity failure, not a test failure.

Scope limits: No secrets, deployment/cutover, billing, or destructive behavior changed.