feat(phases-09-10): add extensions, observability, and release checks

[lyxnbclass]

Summary

• add workspace Skills and isolated lifecycle Hooks (phase 9)
• add redacted workspace-local JSONL events and runtime timeline commands (phase 10)
• add offline Provider/runtime readiness checks without network requests
• add Ruff, Mypy, branch coverage, build, wheel install, and deterministic MockModel release verification
• add Windows/Ubuntu and Python 3.11/3.13 GitHub Actions quality matrix
• mark the phase 0-10 base roadmap complete

Safety boundaries

• events never persist prompts, tool arguments, tool output, or API keys
• .minicode and .minicode-rebuild remain isolated from general model file tools and Git
• readiness validates local configuration only and never performs a billed Provider request
• Hooks do not bypass tool validation, permissions, workspace containment, or checkpoints
• this draft PR does not merge master

Verification

• full suite: 244 passed, 2 skipped
• branch coverage: 85.08% (85% gate)
• Ruff: passed
• Mypy: no issues in 26 source files
• compileall: passed
• sdist and universal wheel build: passed
• clean wheel installation, console version, and MockModel demo: passed
• release_check.py end-to-end: passed

The two local skips require Windows symlink privileges; the Ubuntu CI job covers that path.