Phase A1: bootstrap Python ci_orchestrator package

- pyproject.toml (hatchling) with ruff/mypy/pytest dev deps
- src/ci_orchestrator/: config, credentials, backends (Protocol + WorkstationVmrunBackend), transport (WinRM via pypsrp, SSH via paramiko)
- CLI entry point with PoC 'wait-ready' subcommand (Windows + Linux guests)
- tests/python/: 35 unit tests, 83% coverage, all backends/transport mocked
- gitea/workflows/lint.yml: new 'python' job (ruff + mypy --strict + pytest --cov-fail-under=70)
- config.example.toml + README setup section + .gitignore Python entries

Neutral VmBackend Protocol prepared for Phase C ESXi extension.
See plans/implementation-plan-A-B.md step A1.

src/ci_orchestrator/transport/errors.py

@@ -0,0 +1,23 @@
+"""Transport error hierarchy."""
+
+from __future__ import annotations
+
+
+class TransportError(RuntimeError):
+    """Base class for transport-layer (WinRM/SSH) failures."""
+
+
+class TransportConnectError(TransportError):
+    """Raised when the underlying connection cannot be established."""
+
+
+class TransportCommandError(TransportError):
+    """Raised when a remote command exits non-zero."""
+
+    def __init__(self, returncode: int, stdout: str, stderr: str) -> None:
+        super().__init__(
+            f"Remote command failed (exit={returncode}): {(stderr or stdout).strip()[:500]}"
+        )
+        self.returncode = returncode
+        self.stdout = stdout
+        self.stderr = stderr