Closes #1114. The Stage 2 of #983.

Now that #1108 migrated all in-tree CLI/API callers off the deprecated
package-global path, remove the back-compat shims so the deprecated
symbols are gone from the public surface. External Go importers using
the deprecated path must migrate to the per-DataProvider variants.

Symbols removed from pkg/recipe:

- SetDataProvider / GetDataProvider (and the globalDataProvider /
  dataProviderGeneration / dataProviderMu / getDataProviderGeneration
  package-globals)
- EffectiveDataProvider (was the bound-first / global-fallback shim)
- DefaultRegistry (package-singleton criteria registry shim over
  GetCriteriaRegistryFor(GetDataProvider()))
- ParseCriteriaServiceType / ParseCriteriaAcceleratorType /
  ParseCriteriaIntentType / ParseCriteriaOSType /
  ParseCriteriaPlatformType (package-level shims over
  DefaultRegistry().ParseService / .ParseAccelerator / etc.)
- AllCriteriaServiceTypes / AllCriteriaAcceleratorTypes /
  AllCriteriaIntentTypes / AllCriteriaOSTypes /
  AllCriteriaPlatformTypes (package-level shims over
  DefaultRegistry().AllServiceTypes / etc.)
- BuildCriteria + WithCriteriaService / WithCriteriaAccelerator /
  WithCriteriaIntent / WithCriteriaOS / WithCriteriaPlatform /
  WithCriteriaNodes (and the CriteriaOption type — its sibling
  RegistryCriteriaOption + BuildCriteriaWithRegistry path remains)
- LoadFromFile (package-level wrapper over LoadFromFileWithProvider)

Symbols removed from pkg/validator/catalog:

- Load(version, commit) — back-compat shim over LoadWithDataProvider

Symbols removed from pkg/config:

- (*RecipeSpec).ResolveCriteria — back-compat shim over
  ResolveCriteriaWithRegistry(DefaultRegistry())

Migration & ripples:

- pkg/api/recipe_handler.go: ParseCriteriaFromRequest /
  ParseCriteriaFromBody / ParseCriteriaFromValues now take an explicit
  *recipe.CriteriaRegistry parameter; the handler passes
  h.client.CriteriaRegistry().
- pkg/recipe/handler.go and handler_query.go: pass
  GetCriteriaRegistryFor(b.DataProvider()) on the registry-aware path.
- pkg/recipe/criteria.go: validateAndConvertRawSpec /
  LoadCriteriaFromFile / LoadCriteriaFromFileWithContext /
  loadCriteriaFromHTTPWithContext now take an explicit *CriteriaRegistry.
- (*Criteria).Validate now uses an ephemeral registry and is paired
  with a new ValidateWithRegistry(reg) for callers holding a real one.
- pkg/fingerprint/(*Fingerprint).ToCriteria now takes a
  *recipe.CriteriaRegistry; pkg/cli/query.go passes
  client.CriteriaRegistry().
- pkg/cli/snapshot.go: uses recipe.NewCriteriaRegistry().ParseOS
  instead of the package-level shim.
- pkg/cli/recipe.go: help text + tab completions use the static
  GetCriteria*Types instead of the package-singleton's AllCriteria*Types,
  matching the pre-PR effective behavior at help-generation time.
- pkg/cli/evidence_digest.go: constructs an explicit embedded
  DataProvider for ComputeRecipeDigest.
- pkg/evidence/attestation/ComputeRecipeDigest now takes a
  recipe.DataProvider parameter (was: relied on the package-global).
- pkg/client/v1/aicr.go criteriaFromRequest takes a
  *recipe.CriteriaRegistry; the resolve path passes the Client's own
  registry via GetCriteriaRegistryFor(builder.DataProvider()).
- pkg/config/resolve.go ResolveCriteriaWithRegistry's nil-fallback now
  builds NewCriteriaRegistry() (an ephemeral empty registry) instead
  of DefaultRegistry().
- pkg/validator/catalog/LoadWithDataProvider's nil-fallback now uses
  NewEmbeddedDataProvider directly instead of GetDataProvider().
- pkg/recipe/adapter.go / components.go / metadata_store.go nil-fallbacks:
  same swap.
- pkg/bundler/bundler.go: drops recipe.EffectiveDataProvider in favor
  of inline nil-check on provider before the LayeredDataProvider type
  assertion (type assertions on nil interface return zero/false).
- pkg/recipe/criteria_registry.go GetCriteriaRegistryFor(nil) now
  returns a fresh NewCriteriaRegistry() (not cached) instead of
  caching against the package-global provider.

Test updates:

- Deleted TestDataProviderGeneration, TestEffectiveDataProvider,
  TestRecipeResult_GetValuesForComponent_BoundProviderSurvivesGlobalSwap,
  TestLoadCatalog_DoesNotLeakRegistryOnFailure,
  TestDefaultRegistry_Singleton, TestBuildCriteria, TestWithCriteriaOS,
  TestWithCriteriaNodes — they exercised the deleted shim paths.
- Deleted pkg/recipe/criteria_registry_parse_test.go in full — every
  test in it targeted a deleted symbol.
- Updated remaining tests to use the per-provider variants
  (NewCriteriaRegistry() in place of DefaultRegistry(), method-form
  reg.ParseService in place of ParseCriteriaServiceType, etc.).
- Removed TestMain in validators/deployment that pre-initialized the
  package-global to avoid a parallel-test race — that race is gone
  with the global itself.

External Go importers must update:

  - import path / call patterns from the deleted symbols above
  + per-provider equivalents (recipe.WithDataProvider, the
  + (*CriteriaRegistry).Parse* methods, BuildCriteriaWithRegistry,
  + LoadFromFileWithProvider, catalog.LoadWithDataProvider,
  + ResolveCriteriaWithRegistry).

No behavior change for in-tree CLI/REST callers (they were migrated
in #1108). make qualify clean.

…rror wrap

Addresses CodeRabbit review on #1118:

- pkg/recipe: introduce a package-level defaultEmbeddedProvider
  singleton used as the nil-fallback by LoadMetadataStoreFor,
  GetComponentRegistryFor, and GetManifestContentWithProvider.
  Constructing a fresh *EmbeddedDataProvider on every nil call would
  change the registryCache / storeCache key identity each time,
  defeating the per-DataProvider cache and causing unbounded growth on
  the default path. A single instance gives the cache a stable key.
- pkg/recipe/adapter.go, components.go, metadata_store.go: switch
  every nil-fallback site to use defaultEmbeddedProvider.
- pkg/recipe/adapter.go: update GetManifestContentWithProvider and
  RecipeResult.GetValuesForComponent godoc to reflect the embedded
  fallback (was: "falls back to GetDataProvider()").
- pkg/recipe/criteria_registry.go: drop the now-stale "use
  DefaultRegistry for the package singleton consulted by
  ParseCriteria*Type" wording; retarget the docs to NewCriteriaRegistry
  (ephemeral) and GetCriteriaRegistryFor (per-DataProvider). Drop the
  "global default" reference on GetCriteriaRegistryFor.
- pkg/client/v1/aicr.go criteriaFromRequest: replace errors.Wrap with
  errors.PropagateOrWrap when surfacing recipe.BuildCriteriaWithRegistry
  failures so structured error codes (e.g., ErrCodeInvalidRequest from
  registry parse) survive the boundary instead of being clobbered with
  a fixed ErrCodeInvalidRequest wrapper.

Build, lint, and tests clean on affected packages.

…ale comments

Addresses three more findings on #1118:

- pkg/recipe/handler_query.go: the POST branch validated req.Criteria
  with the no-arg Validate() (which uses a fresh ephemeral
  NewCriteriaRegistry — OSS-only), while the GET branch parsed against
  the per-provider registry already in scope (`reg`). A criteria value
  contributed by a `--data` overlay would be accepted on GET and
  rejected with HTTP 400 on POST against the same handler — a real
  GET/POST asymmetry. Switch the POST validation to
  ValidateWithRegistry(reg) so both verbs honor the same registry.
- pkg/api/recipe_handler.go: same fix in the API server's query
  handler — POST now validates with
  ValidateWithRegistry(h.client.CriteriaRegistry()).
- pkg/bundler/bundler.go: two stale comments referenced
  EffectiveDataProvider (removed by this PR) falling back to the
  package-global. Rewrite both to describe the current behavior:
  bundler asserts on the bound provider directly; a nil interface
  returns (nil, false) from the LayeredDataProvider type assertion
  without panicking, equivalent to no external data.

Build + lint + tests clean.