Add inactive producer config payload

[yihanzhu]

Adds the immutable producer-config payload before profile assembly so a later assembly PR can bind a main-reachable Git revision. The payload remains inactive: it grants no capability and invokes no model, credential, provider, or target.\n\nProof run on d97b8e3:\n- bash scripts/test/default-producer-config.test.sh\n- config-removal ablation: removed the actual config; the test failed with FAIL: config-file; restored it; the focused test passed\n- shellcheck -x -S style scripts/test/default-producer-config.test.sh (ShellCheck 0.11.0)\n- required-files structure loop from CI\n- git diff --cached --check before commit

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: d97b8e3
Reviewed-base: a637451
reviewer: gpt-5.5 @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/231-31309/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The change only adds an inactive default producer config, documentation, manifest coverage, and a focused test. I did not find any introduced behavior that would break existing tests or functionality.