3) If we also want to allow injecting other providers, I would prefer the provider to define to the annotation e.g. @HibernateValidator. This is more consistent with CDI IMO. These providers should not be given the @Default qualifier to stop them conflicting with the default provider.

That is the intention. Each BV provider would provide its qualifier. However, I think it should also be given the default qualifier. I am thinking here of a Java SE environment where I fully control the CDI bootstrapping. In this environment there is no default BV provider and by adding the provider specific extension a user could enable one.