feat: standalone managed Mirror workspace (v0.3.0)

[bhyi4]

Summary

• Product-owned standalone setup/record/verify/doctor/connect/serve commands; no Yeoul or LaneStack requirement.
• Shared managed CLI/MCP capability checks, path boundaries, OS-held workspace locks and durable operation receipts.
• Three workspace task tools prepare before execute, retain stable IDs, replay completed responses and refuse ambiguous retries.
• Exact-file optional read-ledger grants, operator-only audited recovery (including missing-receipt retirement), configuration history and clear trust boundaries.
• Preserve legacy trusted-local APIs, business data and existing client configurations. Raw core CLIs and arbitrary shell commands are explicitly outside the cooperative boundary.
• Version 0.3.0, current docs, native portability CI and installed-wheel tests.

Validation

• Local Linux/Python 3.10 full suite: 127 passed before metadata rebuild; final CI reruns all tests.
• Fresh isolated venv installed the wheel with resolved dependencies; 10 product tests plus installed surface smoke passed outside checkout (MCP 1.30.0).
• sdist -> wheel build succeeded. Product tests cover real stdio reconnect, CLI/MCP shared replay, readonly denial, external ledger read-only grants/revocation, config preservation, and missing-receipt recovery.
• Native macOS/Windows results are pending CI; no cross-product transaction, OS sandbox or exactly-once claim.

Rollout

Stop servers, back up business files AND hidden control metadata, reinstall, run doctor, reconnect.
No operational data migration or existing MCP client configuration was performed.