pub fn audit_providers<'a, I>(providers: I) -> Vec<Offender>Expand description
Audit the resolved provider registry for non-loopback egress.
This is clause (c). It runs after the registry is hydrated from the settings
database, so it sees what a run will actually resolve against — not the YAML,
which seed_providers_from_registry stops honouring once a settings row
exists, and not a file at all for a provider created through the API.
Returns the offenders rather than logging them, so the caller decides
between refusing to boot and reporting. Disabled providers are ignored: a
disabled openai row is inert, and refusing to start because one exists
would make the mode unusable for anyone who has ever configured a vendor.