v0.2.2 Review fixes and validation tooling

Changes

• Convert invalid IANA time-zone input into a clean CLI validation error.
• Document direct tzdata installation for mirrored Windows skill packages.
• Add development-only PyYAML dependency for Codex plugin manifest validation.
• Ignore local .envrc configuration files.

Validation

• Plugin validation passed.
• 16 unit tests passed.