Pin the behaviour that an allowlist-enabled guardrail with no models yields a per-provider empty set (deny every model), distinct from an unrestricted provider. Raised in review.