feat: scaffold read-only sourceosctl CLI

[Copilot]

• Create sourceosctl/ Python package with CLI entry point (cli.py)
• Implement commands: doctor, profiles list, nlboot evidence inspect <path>, release inspect <path>, fingerprint collect --dry-run, ai labs list, agents sandbox plan --dry-run
• All commands are read-only or dry-run; mutating paths rejected with exit code 1
• Add bin/sourceosctl entry-point script (no install required)
• Add fixtures/sample_nlboot_evidence.json and fixtures/sample_release.json
• Add tests/test_cli.py — 21 unit tests covering all commands and error paths
• Add scripts/validate_scaffold.py — fixes GNU Make 4.3 heredoc incompatibility
• Update Makefile — validate now depends on test; test target added
• Update README.md — CLI usage table and running instructions added
• Add/extend .gitignore — excludes __pycache__, build artifacts, .DS_Store, *.tmp
• make validate passes locally (21/21 tests OK, scaffold validation OK)
• Code review: no comments; CodeQL: 0 alerts
• No-op commit pushed to trigger fresh CI check run after workflow approval

[mdheller]

@copilot Scope looks correct for issue #1, but this PR is still draft and the validation workflow is stuck at action_required. Please mark the PR ready for review and refresh/rebase or push a no-op commit if needed so checks rerun under current repo settings. Keep scope unchanged and include/retain validation evidence.

[Copilot]

@copilot Scope looks correct for issue #1, but this PR is still draft and the validation workflow is stuck at action_required. Please mark the PR ready for review and refresh/rebase or push a no-op ...

Pushed commit e6824de (extends .gitignore) to trigger a fresh CI run. Scope is unchanged — make validate passes locally (21/21 tests, scaffold check OK).

Marking the PR ready for review requires a maintainer to click "Ready for review" in the GitHub UI (or approve the workflow run if the action_required status is a first-run protection gate). The commit push will kick off new check runs once the workflow is approved.

[mdheller]

Approved. Scope matches issue #1: read-only/dry-run sourceosctl scaffold, fixtures, tests, README updates, and validation wiring. CI is green and no mutating behavior is introduced.