Canonicalize three-command CLI positioning

[pengfei-threemoonslab]

Summary

• Position the three prominent agent-facing flows consistently: shipgate check, agents-shipgate verify, and shipgate audit --host.
• Bump the runtime contract to version 9, remove verify_local from primary_commands, and keep it in supporting commands metadata.
• Update generated/public surfaces, skills, docs, trigger guidance, boundary next actions, and regenerated llms-full.txt to match the contract.

Validation

• pytest tests/test_cli.py tests/test_local_contract.py tests/test_public_surface_contract.py tests/test_trigger_command.py tests/test_diagnostics.py tests/test_first_look.py tests/test_codex_boundary_check.py tests/test_agent_instructions_renderers.py tests/test_agent_instructions_apply.py tests/test_schema_boundaries.py tests/test_verify.py tests/test_host_audit.py tests/test_preflight.py tests/test_action_metadata.py → 780 passed, 3 skipped
• ruff check src/agents_shipgate tests tools scripts → passed
• PYTHONPATH=src python -m agents_shipgate check --agent codex --workspace . --format codex-boundary-json → decision=warn, completion_allowed=true; warning is the existing undeclared skill-surface coverage note for generated skill files.