Support system Python 3.9 without extra installs

[erickkkyt]

What changed

• support Python 3.9+ by bundling the MIT-licensed tomli parser
• test Python 3.9 and 3.10 in CI
• keep DeepSeek API keys out of macOS process arguments
• avoid implicit Windows executable discovery; require an explicit trusted runtime path

Verification

• 39 tests pass with macOS system Python 3.9
• 39 tests pass with bundled Python 3.12
• skill validation and Python compilation pass
• final Codex Security scan completed with no HIGH findings