skillruntime: add skill lifecycle facade foundation

[VelariumAI]

Summary

Adds a deterministic SkillRuntime lifecycle facade foundation under pkg/skillruntime.

What changed

• Added lifecycle operation model:
  • retrieve
  • propose
  • validate
  • stage
  • promote
  • disable
• Added bounded skill candidate model.
• Added lifecycle request/result models.
• Added facade methods:
  • Retrieve
  • Propose
  • Validate
  • Stage
  • Promote
  • Disable
  • Run
• Added in-memory Store / MemoryStore.
• Added profile/evidence integration through:
  • profile.Config
  • profile.EvaluateCapability
  • evidence.Assessment
  • evidence.Receipt
  • evidence.Record
• Added consumption of provided harness/replay/statelock structures without executing those engines.
• Added trace-compatible refs:
  • CandidateRef
  • ResultRef
• Added tests for lifecycle behavior, promotion safety, disable safety, evidence/profile gates, store behavior, redaction, and refs.
• Updated promotion manifest for new managed files.

Operational posture

• No runtime enforcement added.
• No default behavior changed.
• No automatic promotion execution added.
• No live planner mutation added.
• No governance/tool/selfmod/researchgate behavior changed.
• No trace persistence changed.
• No replay execution changed.
• No tool/provider/network execution added.
• No file/network IO added.
• No database storage added.
• No background workers added.
• No vector/semantic-memory statefulness changed.
• No Workbench/UI work.
• No release-readiness tooling added.
• No release workflow run.

Safety posture

• Promote does not install, activate, register, or mutate live runtime skills.
• Disable does not mutate a global/runtime skill registry.
• Optional disable behavior is limited to in-memory store state.
• Automatic promotion remains future-configurable but is not executed in this PR.
• Policy absence is not treated as permission.
• Vector retrieval remains candidate-only and is not treated as truth.
• Promotion paths require evidence receipt plus rollback/disable evidence for pass-like outcomes.
• Adverse replay/statelock evidence cannot silently pass.

Review status

Independent review verdict: APPROVE.

Review confirmed:

• narrow but complete lifecycle facade
• no runtime mutation
• no automatic promotion
• bounded/redacted data
• defensive cloning
• vector/semantic memory preserved
• no sensitive sinks
• no public attribution
• manifest in sync

Validation

• go test ./pkg/skillruntime passed.
• Targeted package tests passed.
• go test ./... passed.
• go vet ./... passed.
• git diff --check passed.
• bash scripts/check_promotion_manifest.sh passed with 901 / 901 managed files.
• Private scanner finding zero_proofs_3 | reasoning/ classified as unrelated / false-positive for this PR scope.

Deferred follow-ups

• Runtime consumption of SkillRuntime facade.
• Failure-to-skill-to-harness distillation.
• Persistent skill store, if needed later.
• Configured promotion execution under explicit profile/config gates.
• Release-readiness interaction tooling before post-PR-015 release.