OIC agent provider interface, with a fake provider for tests #222

Context

OIC runs investigations through coding agents, but the domain must not depend on any provider's session format. Depends on #220.

Behavior to implement

An AgentProvider interface:

• start(task) -> run, plus streaming or polling of normalized events: message, question, tool_use, structured_output, completed, failed, timed_out.
• resume(run, checkpoint): continue the provider session when it supports that, otherwise start a fresh session from the persisted checkpoint.
• Provider session IDs stay in AgentRun.runtime_metadata and never reach domain objects or public responses.

A FakeProvider that replays scripted events (ask a question, return proposals, fail midway) for deterministic tests.

Acceptance criteria

• Lifecycle tests for OIC investigation lifecycle: state machine, events, and checkpoints #225 and OIC durable job worker: retries, idempotent commits, restart recovery #226 run on FakeProvider with no network.
• A test checks that domain and service modules don't import provider SDKs.