Add a "Choosing a provider" section to the README

[turbomam]

The README documents the access_provider variables (pnnl, cborg, gcp) but never explains what each provider is or how to choose one. A new user editing .env has no basis for picking. Follows on from #95 and #96, which sync the variable docs but do not explain the choice.

Propose a short "Choosing a provider" section covering, for CBORG, PNNL AI Incubator, and GCP / Vertex:

• what it is and who can use it (LBL, PNNL, or a GCP service account)
• which credentials it needs
• which run paths it supports: the single-pass run_recommendation_pipeline, and the agentic path from Agentic Architecture #91, which appears to require Claude on Vertex and so GCP only
• rough tradeoffs (cost, rate limits, model coverage)

Some of this needs input only the team has, so flagging for @hesspnnl:

• which models each provider actually reaches
• why the examples default to pnnl
• whether the agentic path is intentionally GCP-only for now

Keep it short: a small table plus a sentence or two per provider.

[turbomam]

Two CBORG-specific points for the provider section, verified while testing this morning:

• CBORG requires LBLnet or an authorized IP. Off-network calls return a 403: "Access denied: IP address ... is not recognized. Connect via LBLnet or VPN", and you authorize an IP at https://api.cborg.lbl.gov/key/manage.
• The base URL is https://api.cborg.lbl.gov, with no /v1 suffix (confirmed by listing models).

[turbomam]

Verified GCP/Vertex setup for the single-pass provider, for the provider section:

1. Obtain the nmdc-llm Vertex service account JSON (from Sierra, or an existing copy).
2. In .env:
   • GOOGLE_APPLICATION_CREDENTIALS=<absolute path to that JSON> (keep the file outside the repo so it cannot be committed).
   • VERTEX_PROJECT_ID=nmdc-llm (the project id; also readable as the JSON's project_id).
   • Region: us-east5 is confirmed to serve gemini-2.5-flash. Leave GEMINI_REGION / CLOUD_ML_REGION at us-east5 or unset to use the code default.
3. On the GCP side: the project needs the Vertex AI API enabled and the service account needs the Vertex AI User role.
4. Verify: LLMClient(access_provider="gcp", model="gemini-2.5-flash") through run_recommendation_pipeline returns suggestions. As with the other providers, values come back empty by design (field guidance).

Alternative to a service account file: application-default credentials (gcloud auth application-default login) plus VERTEX_PROJECT_ID.

Gotcha we hit while setting this up: the .env.example region placeholder (region) silently produced a Vertex 404 (invalid region in the request URL). Fixed in PR #96.