Threads function_providers through the durable path

[johnnyt]

Bead: sp-aa9z

What changes

statifier 2.15.0 lets a host register guard functions a chart's cond and expr may call (:function_providers, st-ADR-0078). A decoded position carries functions: nil, so a host resuming an execution through this package had to call Statifier.MachineState.put_function_providers/2 itself before each step. This PR makes the package stamp the list:

• Executions.step/5 takes function_providers: per call and re-stamps it in step_loaded/8 beside routes, invoke_types and send_types. The st-ADR-0064 tripwire now matches functions: nil as well.
• Executions.create/4 takes it inside initialize:, the same way it takes the other snapshots.
• Driver.new/3 takes it as a driver-level default. The driver carries it into initialize: on a create and onto every step, and a call's own function_providers: outranks it, an explicit nil included.
• The entry refusal: a list that does not resolve through Statifier.Evaluator.Functions.from_providers/1 answers {:error, {:function_providers, reason}} before any lock, load or write. This happens on step/5 and create/4, and on the driver's create/3, send_event/4, done_invocation/5, failed_invocation/5 and answer_parent/3. t:Executions.error/0 gains the arm, and t:Executions.function_providers_reason/0 names the reasons.
• A durable subchart child the driver creates does not inherit the list. When the driver answers the parent, the parent's step does use it.
• The statifier requirement moves from ~> 2.9 to ~> 2.15, locked at 2.15.0 (predicator moves from 9.4.2 to 9.4.4 in the lock as statifier's own dependency).
• Docs: the t:step_opt/0, t:create_opt/0 and t:error/0 typedocs, the step/5 and create/4 docs, the Driver's option list, one README paragraph, and the upgrading page's floor sentence. That sentence now says every release through 0.24.2 keeps ~> 2.9 and the next release moves the floor to ~> 2.15. Before this edit it said "every later release keeps it there", which this PR makes false.
• The changelog fragment changelog.d/sp-aa9z.md carries the Added and Changed lines.
• The record: an Amendment to ADR-0004 at proposed, appended at the foot. Decision 3's re-stamp gains functions; the Amendment also records the entry refusal, where the option reaches, and why a child does not inherit it. It removes zero lines.

Without function_providers:, nothing changes. The step stamps nil, which is what the decoded position already carries.

Provenance

• The entry refusal was ruled by the operator, 2026-10-12.
• Where the option reaches, and that a durable child does not inherit it, were decided by the conductor under a standing consent, 2026-10-12.
• The statifier requirement ~> 2.15 was decided by the conductor under a standing consent, 2026-10-12.
• How non-inheritance is built: the plan was to set the field to nil on the child's driver struct. Instead, create_child/6 passes function_providers: nil on the child's create options. That option outranks the driver's list on the child's create and on every step of its drive, while the struct keeps the list. The reason: the same struct answers the parent once the child is terminal, and the parent's step has to take the host's list. The record says so, and a test pins each half.
• The driver checks the list at its own doors as well as at the Executions entry. Without the driver-side check, answer_parent/3 would write the child's answer to the child's record before the parent's step refused.
• The existing test that checks the option keys per type (executions_opt_types_test.exs) gains :function_providers in the step set and in the set a create ignores.

Verification

• On statifier 2.15.0, before any code change, the existing suite passed unchanged: 1432 tests, 0 failures. No existing answer moved.
• The full mix quality gate is green on this commit: format, compile with warnings as errors, credo, docs, doc links, unused deps, 1,445 tests with 96.0% coverage, and dialyzer. The doctor, gettext and sobelow stages are not installed in this project. The suite ran against a local Postgres server on 5432.
• test/statifier_persistence/function_providers_test.exs covers each clause above. Every new test carries a sabotage note for a mutation that turned it red on an assertion. The extended tripwire test turns red when Statifier.Position keeps functions through a round trip.

Record direction check

Each claim in the Amendment was read against this branch and statifier v2.15.0:

• Statifier.Position drops functions on encode and decode, and statifier's own refusal is spelled {:error, {:function_providers, reason}}; both are st-ADR-0078 decisions 4 and 5.
• MachineState.new/2 raises on a bad list.
• Statifier.Invoke.Source.resolve/2 compiles a child with no :function_providers.
• The code this PR adds is cited by anchor only, because it exists only on this branch.
• git diff origin/main -- docs/adr/ shows zero removed lines.

Tier: contract (a new public option, a new error arm, and a record). The cold review is the conductor's.