feat: architecture improvements, performance optimizations, security hardening (M24) (#417)

* feat: architecture improvements, performance optimizations, security hardening (M24)

Extract ProviderKind enum replacing stringly-typed provider selection.
Group Agent loose fields into RuntimeConfig struct.
Consolidate provider construction via shared create_named_provider.
Add AnyProvider::embed_fn() eliminating duplicate closures.
Move AnyChannel to zeph-channels crate.
Trim default features to minimal set (qdrant, self-learning, vault-age).

Performance: String::with_capacity in context loops, buffer_unordered(20),
embedding timeout wrappers, inline cosine_similarity.

Security: reject empty Telegram allowed_users, Config::validate() with
bounds checking, sanitize_paths() for error message path disclosure.

Resolves #392, #394, #395, #396, #397, #399, #401, #403, #404, #405,
#408, #409, #412, #415, #416

* fix: update integration test for ProviderKind enum

Replace string comparison with ProviderKind::Ollama in config defaults test.

* docs: update documentation, changelog, and readme for M24

Update feature-flags, configuration, channels, architecture, and
security docs to reflect ProviderKind enum, minimal default features,
Telegram auth guard, config validation, and path sanitization.

Add doc tests step to CI workflow.
Update CHANGELOG.md with Unreleased section for M24 changes.
Update README.md with new feature flags and architecture notes.

Author: bug-ops

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
           cache-targets: "false"
       - uses: mozilla-actions/sccache-action@v0.0.9
       - name: Clippy
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --features full -- -D warnings
         env:
           RUSTC_WRAPPER: sccache
           SCCACHE_GHA_ENABLED: "true"
@@ -67,7 +67,12 @@ jobs:
       - uses: mozilla-actions/sccache-action@v0.0.9
       - uses: taiki-e/install-action@nextest
       - name: Run tests
-        run: cargo nextest run --workspace --lib --bins
+        run: cargo nextest run --workspace --features full --lib --bins
+        env:
+          RUSTC_WRAPPER: sccache
+          SCCACHE_GHA_ENABLED: "true"
+      - name: Run doc tests
+        run: cargo test --workspace --features full --doc
         env:
           RUSTC_WRAPPER: sccache
           SCCACHE_GHA_ENABLED: "true"
@@ -86,7 +91,7 @@ jobs:
       - uses: mozilla-actions/sccache-action@v0.0.9
       - uses: taiki-e/install-action@nextest
       - name: Run integration tests (testcontainers)
-        run: cargo nextest run --workspace --profile ci --test '*integration*'
+        run: cargo nextest run --workspace --features full --profile ci --test '*integration*'
         env:
           RUSTC_WRAPPER: sccache
           SCCACHE_GHA_ENABLED: "true"
@@ -106,7 +111,7 @@ jobs:
       - uses: taiki-e/install-action@cargo-llvm-cov
       - uses: taiki-e/install-action@nextest
       - name: Generate coverage
-        run: cargo llvm-cov nextest --workspace --lib --bins --lcov --output-path lcov.info
+        run: cargo llvm-cov nextest --workspace --features full --lib --bins --lcov --output-path lcov.info
         env:
           RUSTC_WRAPPER: sccache
           SCCACHE_GHA_ENABLED: "true"

CHANGELOG.md

@@ -6,6 +6,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Added
+- `ProviderKind` enum for type-safe provider selection in config
+- `RuntimeConfig` struct grouping agent runtime fields
+- `AnyProvider::embed_fn()` shared embedding closure helper
+- `Config::validate()` with bounds checking for critical config values
+- `sanitize_paths()` for stripping absolute paths from error messages
+- 10-second timeout wrapper for embedding API calls
+- `full` feature flag enabling all optional features
+
+### Changed
+- `AnyChannel` moved from main.rs to zeph-channels crate
+- Default features reduced to minimal set (qdrant, self-learning, vault-age, compatible, index)
+- Skill matcher concurrency reduced from 50 to 20
+- `String::with_capacity` in context building loops
+- CI updated to use `--features full`
+
+### Breaking
+- `LlmConfig.provider` changed from `String` to `ProviderKind` enum
+- Default features reduced -- users needing a2a, candle, mcp, openai, orchestrator, router, tui must enable explicitly or use `--features full`
+- Telegram channel rejects empty `allowed_users` at startup
+- Config with extreme values now rejected by `Config::validate()`
+
+### Deprecated
+- `ToolExecutor::execute()` string-based dispatch (use `execute_tool_call()` instead)
+
+### Fixed
+- Closed #410 (clap dropped atty), #411 (rmcp updated quinn-udp), #413 (A2A body limit already present)
+
 ## [0.9.9] - 2026-02-17
 
 ### Added