fix(providers): address adversarial review findings F1, F4, F6, F9

F1: TestModelRegistry_MaybeRefresh_Throttled_OnePerInterval mutated a
plain `now` variable while a background refresh goroutine read it
through nowFn, racing under -race in about 14% of full-suite runs once
this branch's timer-heavy tests shared the parallel phase. Guards the
clock with a mutex instead. registry.go is untouched.

F4: a mid-body watchdog timeout never reached provider-health
accounting. limiter.recordProviderAttempt only ran at header-arrival
time, so a provider that reliably stalled mid-body reported
attempts=1 failures=0 forever. watchdogBody.fire now invokes the same
attemptRecorder a second time, as a failure, when it fires. Reuses the
existing recorder rather than adding new plumbing; this does mean two
attempts are recorded for one logical request (one success at header
time, one failure at watchdog-fire time), not one attempt marked
failed outright.

F6: watchdogBody.Read reset the timer on any err == nil read,
regardless of n. A reader returning (0, nil) forever would have held
the watchdog open indefinitely. Reset now only fires when n > 0.

F9 (three items):
- proxyUpstream passed logPrefix as a bare providerName, which
  newWatchdogBody wrapped in a hardcoded `provider %q` — labeling an
  MCP/A2A target as a provider. watchdogBody now takes an
  already-formatted label from the caller instead.
- errUpstream was wrapped twice: once in watchdogBody's own error, once
  again by every caller that already wraps it. watchdogBody now wraps
  only errProviderTimeout; callers' existing wraps still make
  errors.Is(err, errUpstream) hold.
- timeout_test.go read wb.timedOut directly in one place while every
  other access is atomic; switched to atomic.LoadInt32.

Also rewords errProviderTimeout's message from "provider request timed
out" to "upstream progress stalled" (finding F3, documented not fixed
per coordinator ruling): the watchdog measures time since the last
successful upstream read, which can go quiet because of a slow client
write between reads, not only a slow provider. The new wording no
longer asserts which side caused it.

New tests: TestChatCompletion_Stream_StallsMidBody_RecordsProviderFailure,
TestWatchdogBody_ZeroByteRead_DoesNotResetTimer,
TestWatchdogBody_TimeoutError_UsesCallerLabel_NotHardcodedProvider.
Each mutation-verified per its own doc comment.

registry_test.go

@@ -505,8 +505,26 @@ func TestModelRegistry_MaybeRefresh_Throttled_OnePerInterval(t *testing.T) {
 	if err != nil {
 		t.Fatalf("newModelRegistry: %v", err)
 	}
-	now := time.Now()
-	reg.nowFn = func() time.Time { return now }
+	// clockMu guards clock: reg.nowFn runs on maybeRefresh's own
+	// background refresh goroutine (registry.go), concurrently with this
+	// test's own goroutine advancing the clock below a few lines down. A
+	// plain `now` variable closed over by both was a genuine data race
+	// (coordinator adversarial review, 2026-08-23) — the 10ms sleep below
+	// gave the background goroutine a chance to finish reading it first,
+	// but that is a race won by scheduling luck, not a happens-before
+	// guarantee, and -race caught it in roughly 14% of full-suite runs.
+	var clockMu sync.Mutex
+	clock := time.Now()
+	reg.nowFn = func() time.Time {
+		clockMu.Lock()
+		defer clockMu.Unlock()
+		return clock
+	}
+	advanceClock := func(d time.Duration) {
+		clockMu.Lock()
+		clock = clock.Add(d)
+		clockMu.Unlock()
+	}
 
 	reg.maybeRefresh(context.Background())
 	waitUntil(t, time.Second, func() bool { return atomic.LoadInt32(&calls) == 1 })
@@ -518,7 +536,7 @@ func TestModelRegistry_MaybeRefresh_Throttled_OnePerInterval(t *testing.T) {
 		t.Errorf("listModels called %d times within one interval, want 1", got)
 	}
 
-	now = now.Add(2 * time.Hour) // past the interval: next entry should refetch
+	advanceClock(2 * time.Hour) // past the interval: next entry should refetch
 	reg.maybeRefresh(context.Background())
 	waitUntil(t, time.Second, func() bool { return atomic.LoadInt32(&calls) == 2 })
 }