chore: bootstrap repository development tools

[douglasmonsky]

Summary

• add one repository-owned bootstrap for fresh and reused Python developer environments
• verify every active dev requirement, exact editable worktree identity, Scalene 2.3.0, and package consistency
• pin GitNexus 1.6.9 in a repository-private integrity lock and serialize exact-worktree index repair
• require physical-root, branch, commit, and origin/main compare coherence before agent work
• document the mandatory root/subagent readiness workflow

Why

Subagents repeatedly encountered reused environments missing the declared profiler or stale and ambiguous GitNexus state. This makes readiness deterministic once per worktree and turns later checks into bounded no-ops.

Safety

• rejects external .venv symlinks before inspection or mutation
• never installs global or transient GitNexus tools and never uses latest or npx
• performs only index-only GitNexus analysis; no clean, wiki, embeddings, registry deletion, API keys, or usage-data access
• uses exact physical worktree paths and origin/main, avoiding duplicate-name and stale-main comparisons

Validation

• focused bootstrap and scope suite: 46 passed
• just vp passed
• full just v: 559 passed; Ruff, MyPy, Pyright, Xenon, and release safety clean
• real fresh locked install/index followed by two mutation-free checks passed
• agent-perf run 20260729T015135Z-48413e39 completed with Scalene 2.3.0; identical unprofiled check passed
• GitNexus staged and origin/main comparisons both reconciled exactly seven files
• final review: four findings, all four accepted and resolved; reviewer token attribution pending because the installed tracker lacks the strict command