pub fn preflight_cloud_capability(
provider: CloudProviderId,
needs_tools: bool,
) -> Result<(), BrokerError>Expand description
Build the right broker for a credential source. Local sources get the in-process broker (no daemon needed); remote sources get the authenticated Pre-flight capability check for a cloud route (spec §5.5). Pure function: callers MUST run it before constructing a broker, looking up credentials, or opening any connection. The invoke-time guard inside the broker remains in place as defense in depth.