fix: read-only candidate-check and bot no-sync for stale venv safety

[yastman]

Summary

Read-only frozen check for candidate/review validation and uv run --no-sync for bot runtime loops to prevent implicit .venv mutations.

Changes

• Makefile: Add check-frozen/candidate-check targets that run uv sync --frozen --check before lint + MyPy with uv run --no-sync. Switch preflight-bot to module invocation via python -m scripts.probe.check_bot_runtime_env. Switch run-bot and bot to $(UV_RUN_NO_SYNC), preserving log tee + exit status in bot. Keep bot-response-smoke on plain uv run (it's a verification gate, not a runtime loop, and benefits from the auto-sync guarantee).
• docs/LOCAL-DEVELOPMENT.md: Document candidate-check usage, no-sync behavior, stale .venv remediation, and worktree handling.

Verification

• make -n candidate-check — correct recipe: frozen check → no-sync lint + MyPy
• make candidate-check (absent .venv) — fails without creating/modifying .venv with clear error guidance
• uv run --no-sync python -m scripts.probe.check_bot_runtime_env --skip-docker — module invocation works
• make -n bot, make -n run-bot, make -n preflight-bot — all use uv run --no-sync
• make docs-check — all links OK
• git diff --check — clean

Fixes #2285
Fixes #2289

[yastman]

Review disposition: request_changes (formal review is blocked by GitHub because this is my own PR)

Findings

1. Medium: update the Makefile contract with the new module invocation
   Makefile:385 changes preflight-bot from python scripts/probe/check_bot_runtime_env.py to python -m scripts.probe.check_bot_runtime_env, but tests/unit/test_makefile_contract.py:529 still asserts the old script-path string. The current PR therefore breaks the local fast gate: UV_PROJECT_ENVIRONMENT=/home/user/projects/rag-fresh/.venv uv run --no-sync pytest tests/unit/test_makefile_contract.py::test_preflight_bot_runs_python_script -q fails with AssertionError: preflight-bot must invoke scripts/probe/check_bot_runtime_env.py. This blocks merge; the contract should be updated to accept the intended module invocation and keep checking that PREFLIGHT_BOT_FLAGS are passed.

Verification

• make -n candidate-check, make -n preflight-bot, make -n run-bot: passed dry-run; recipes render as intended.
• UV_PROJECT_ENVIRONMENT=/home/user/projects/rag-fresh/.venv uv run --no-sync python -m scripts.probe.check_bot_runtime_env --help: passed.
• UV_PROJECT_ENVIRONMENT=/home/user/projects/rag-fresh/.venv uv run --no-sync pytest tests/unit/test_makefile_contract.py::test_preflight_bot_runs_python_script -q: failed as above.
• Candidate make test also fails on this same contract failure. It additionally hit collection errors from the shared root .venv/editable state, so I am not attributing those import errors to this PR.

Disposition: request_changes.