Round-6 claude-review (ready to merge): the three new GatewayProvider usage/bearer tests lacked @pytest.mark.unit, so `pytest -m unit` skipped them even though every other new test in this PR is marked. Add the marker to the three new tests (leaving the pre-existing unmarked tests in the file alone). Remaining 🟢 items (OpenAI embed() dual path, recursion-invariant runtime enforcement, Bedrock sync-in-async) are acknowledged deferrals — separate refactors, unchanged. Deck #67. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>