feat(skills): add list-hygiene-judge

[martinextrabox-netizen]

Summary

• add the public list-hygiene-judge skill with a cold-operator manual and a declarative graph
• read the durable contact projection before judgment, persist only re_permission or suppress through compare-and-set plus a stable idempotency key, then verify durable readback
• declare contact_readback explicitly on the decision runner and turn append/readback disagreement into a sealed governed stop rather than an exception or false success
• cover engagement decay, hard-bounce suppression, stale evidence, active unsubscribe, readback mismatch, and a seeded stream whose durable version is greater than zero

Validation

• runx skill inspect ./skills/list-hygiene-judge --json: status: ok, readiness: ready, fully bound on Runx CLI 0.8.2
• deterministic domain checks exercised re-permission, suppression, stale evidence, unsubscribe, seeded version 1 -> 2, and mismatched readback behavior
• all four commits include the required DCO sign-off
• the published Windows 0.8.2 worker reaches the package cases but cannot install Job Object containment on this host (Failed to set info for job), so the native harness cannot honestly be reported as passing locally; Linux CI is expected to provide the authoritative replay

Bounty context: Frantic #68, list hygiene judge

[martinextrabox-netizen]

@auscaster This PR implements the list-hygiene-judge contract and specifically covers the prior durable-version/readback and governed-stop failure modes from Frantic #68. The two workflows from the fork are currently awaiting maintainer approval. Could you approve the runs and review the package when convenient?