refactor: depend on the published core, drop the vendored copies

[imran-siddique]

agentrust-capture-core 0.1.0 is live on PyPI, so the four engines import it as a declared dependency. Removes ~24 duplicated files, the sync script, and the drift check that existed only because copies rot.

This gives up the zero-install property

That was a real promise, stated in three requirements.txt files and four READMEs, so it is worth naming rather than glossing. Three consequences, all handled:

The requirements files were lying. Each said the drift check "uses only the Python standard library — nothing here is needed for them". Now each leads with the core as REQUIRED, and the signing packages are demoted to a "signing only" section. copilot gained a requirements.txt it never had.

The Copilot action had no install step, because it relied on the vendored copy. It now installs the core, pinned >=0.1,<0.2 so a core release cannot silently change what the check measures.

A missing core used to fall through to the vendored copy. Now it raises with the package name and the exact command:

AgenTrust needs agentrust-capture-core, which is not installed.
Install it with:  pip install agentrust-capture-core
Drift detection cannot run without it.

That matters more than it looks. The hook's last-resort guard would otherwise catch the ImportError and emit "integrity check skipped this session", which tells a user nothing about what to do and is exactly the vague failure this project keeps arguing against.

READMEs in claude-code, scheduled-agents, copilot and the package all claimed dependency-free or no-install-step. Corrected.

CI changes shape rather than shrinking

vendored-in-sync is gone because there is nothing left to compare. bare-install-fallback is replaced by two jobs that assert the opposite of what it did:

Job	Asserts
engines-import-against-the-installed-core	every engine imports a freshly installed core, and that it did not come from a vendored path
missing-core-fails-clearly	the engine exits non-zero and names pip install agentrust-capture-core

The publish workflow loses its consistency job for the same reason.

Test plan

• 184 passed across all five suites.
• ruff check --target-version py39 clean.
• Missing-core path exercised locally by blocking the import through a meta_path hook: exits 1 with the install instruction.
• Every engine confirmed loading the core from site-packages rather than a vendored path.

The remaining failure is the pre-existing codex TRACE conformance test.

One caveat for existing users

Anyone who installed the plugin before this needs pip install agentrust-capture-core or their next session reports the check could not run. The error says so explicitly, but it is a breaking change for a bare install and worth a line in the changelog when this is released.