Lightweight tag for the active embedder, returned by
probe_active_embedder so callers can render the right hint copy without
re-implementing the priority chain.
Sentinel stored in context_engine.embedding_provider_url when the
user explicitly picked the cloud-managed embedding source. The
get_embedder chain treats this as “use CloudEmbedder if logged in,
otherwise local lexical hash” — it must never be sent as a real URL to
OpenAICompatEmbedder.
Inspect the currently-resolved embedder and report its kind. Mirrors the
priority chain in get_embedder (explicit BYOK → cloud → SHA1) without
allocating the actual embedder. BYOK is checked first so a BYOK user never
triggers a cloud-auth.db decrypt just to report status.
Sync sibling of probe_active_embedder for non-async render paths (the
TUI status bar). Runs the authoritative async probe on a short-lived
scratch runtime on its own thread, so it returns the EXACT same answer as
the runtime resolver — real token load (DIFFLORE_TOKEN env + decrypted
cloud-auth.db row) and BYOK key validation — with no separate sync
detection logic that could drift. The caller caches the result, so this
only spawns on a cache miss.