chore: disable resource-heavy CI workflows

[waple0820]

Summary

• Disable resource-heavy or privileged workflows by renaming them to .disabled: Claude bot, cloud eval dispatch, Docker publish, PR eval trigger, package matrix, PyPI publish, and stale bot.
• Keep the basic lint, test, and install-script workflows active.
• Reduce test.yaml permissions to read-only contents: read, remove real provider secrets from the test matrix, and drop the agent eval/commenting job.

Validation

• PATH=/Users/avatar/.local/share/uv/python/cpython-3.11.14-macos-aarch64-none/bin:$PATH uv run pre-commit run --all-files
• git diff --check
• Parsed enabled workflow YAML files successfully.
• Confirmed enabled workflows contain no secrets.*, write permissions, release/schedule triggers, publish steps, or external eval dispatch.