v0.9.0 — CPU microarch tuning

`autokernel propose` now auto-detects the host CPU's microarchitecture and recommends the matching `CONFIG_M=y` symbol. Coverage:

• AMD: K8, K10, Bulldozer family, Zen 1–5 (Genoa, Phoenix, Strix Point)
• Intel: Family-6 from Nehalem through Lunar Lake / Arrow Lake; Atom line (Silvermont → Gracemont)

Detection is kernel-version aware — it won't recommend `CONFIG_MMETEORLAKE` on a kernel too old to know that symbol; falls back to leaving `CONFIG_GENERIC_CPU` alone.

How it integrates

• New `ProposalSource.MICROARCH` distinguishes CPU tune from other deterministic rules.
• `apply_policy` treats microarch like deterministic at ADVISE — auto-applied (it's a hardware fact, not a judgment call).
• `kfrag` writer now emits `CONFIG_FOO=y` enable lines alongside disables and demotions.
• `cli.propose` shows "CPU tune: → CONFIG_M=y" at the top of the run.
• `--no-cpu-tune` flag opts out.

Verified live

On the box this was developed on (Intel Core Ultra 7 165H, family 6 model 170 → Meteor Lake):

```
$ autokernel propose /tmp/snap --skip-llm
CPU tune: Intel(R) Core(TM) Ultra 7 165H → CONFIG_MMETEORLAKE=y (microarch: METEORLAKE)
deterministic proposals: 9
auto-applied (9): … includes CONFIG_MMETEORLAKE n→y
```

Tests

481 total, ~4s. 55 new tests cover the microarch lookup tables, kernel-version awareness, and end-to-end integration with the proposal pipeline.