Phase A1: bootstrap Python ci_orchestrator package

- pyproject.toml (hatchling) with ruff/mypy/pytest dev deps
- src/ci_orchestrator/: config, credentials, backends (Protocol + WorkstationVmrunBackend), transport (WinRM via pypsrp, SSH via paramiko)
- CLI entry point with PoC 'wait-ready' subcommand (Windows + Linux guests)
- tests/python/: 35 unit tests, 83% coverage, all backends/transport mocked
- gitea/workflows/lint.yml: new 'python' job (ruff + mypy --strict + pytest --cov-fail-under=70)
- config.example.toml + README setup section + .gitignore Python entries

Neutral VmBackend Protocol prepared for Phase C ESXi extension.
See plans/implementation-plan-A-B.md step A1.

config.example.toml

@@ -0,0 +1,30 @@
+# ci-orchestrator config example.
+#
+# Copy to $CI_ROOT/config.toml or set $CI_CONFIG to the file path.
+# Environment variables (CI_ROOT, CI_TEMPLATES, CI_BUILD_VMS, CI_ARTIFACTS,
+# CI_KEYS, CI_VMRUN_PATH, CI_SSH_KEY_PATH, CI_GUEST_CRED_TARGET) override
+# anything set here.
+
+# --------------------------------------------------------------- Windows host
+[paths]
+root       = "F:/CI"
+templates  = "F:/CI/Templates"
+build_vms  = "F:/CI/BuildVMs"
+artifacts  = "F:/CI/Artifacts"
+keys       = "F:/CI/keys"
+
+# Phase B (Linux host) — uncomment after migration.
+# [paths]
+# root       = "/var/lib/ci"
+# templates  = "/var/lib/ci/templates"
+# build_vms  = "/var/lib/ci/build-vms"
+# artifacts  = "/var/lib/ci/artifacts"
+# keys       = "/etc/ci/keys"
+
+# Phase C hook: backend selector. Only "workstation" is implemented in Phase A.
+[backend]
+type = "workstation"
+
+vmrun_path        = "C:/Program Files (x86)/VMware/VMware Workstation/vmrun.exe"
+ssh_key_path      = "F:/CI/keys/ci_linux"
+guest_cred_target = "BuildVMGuest"