chore(apply): log deferred provider checks on the tree path (§5.5 review)

The single-node path runs `check_imports_resolve` +
`check_extension_points_provided`; the tree path can't (an in-tree,
uncommitted node may legitimately provide a module, so a pool-based check
would false-positive) and leans on the runtime backstop. Emit a debug log
when a tree apply contains app nodes so the deferral isn't a silent gap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -1276,6 +1276,22 @@ impl ApplyService {
             });
         }
 
+        // §5.5 / Phase 4b: the single-node path runs `check_imports_resolve` and
+        // `check_extension_points_provided`, but the tree path cannot — a node
+        // may legitimately import a module another in-tree (uncommitted) node
+        // declares, so a pool-based provider check would false-positive. Both
+        // lean on the runtime backstop here. Log it so the gap isn't silent.
+        if prepared
+            .iter()
+            .any(|p| matches!(p.owner, ApplyOwner::App(_)))
+        {
+            tracing::debug!(
+                nodes = prepared.len(),
+                "tree apply: per-node import / extension-point provider checks \
+                 deferred to the runtime backstop (single-node-only at plan time)"
+            );
+        }
+
         // Fold in every in-scope group's structure version, so a reparent or a
         // new app under the subtree between plan and apply trips StateMoved.
         for gid in &versioned_groups {