feat(tools/fossil): implement Fossil SCM VCS backend and forge/tracker bridge (#604)

[onlyarnav]

Summary

• Add tools/fossil/ bridge for Fossil SCM — the distributed VCS with an integrated issue tracker, wiki, and forum in a single SQLite-backed file. Fossil collapses the forge + tracker + VCS split the rest of our bridges assume, so this single adapter covers what tools/github/ + a VCS shim cover separately.
• Extend tools/vcs/ with FossilBackend and a new cat subcommand (file-at-version retrieval, implemented across Git, Mercurial, and Fossil).
• Motivation: Fossil is the home of SQLite, Tcl/Tk, and Fossil itself — projects that deliberately chose an all-in-one self-hosted tool over a forge. This closes the tracked extension point feat(tools/fossil): Fossil VCS + integrated-tracker bridge (SQLite, Tcl/Tk) #604 and moves Fossil from "tracked" to "shipping" in the adapter registry.

Type of change

• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Documentation (docs/, README.md, CONTRIBUTING.md)

Test plan

• For Python packages touched: uv run pytest / ruff check / mypy passes
  • uv run --directory tools/fossil pytest — 15 passed
  • uv run --directory tools/fossil ruff check — All checks passed
  • uv run --directory tools/fossil mypy — Success: no issues found in 7 source files
  • uv run --directory tools/vcs pytest — 21 passed, 4 skipped (Mercurial skipped due to missing hg)
  • uv run --directory tools/vcs ruff check — All checks passed
  • uv run --directory tools/vcs mypy — Success: no issues found in 2 source files
  • uv run --directory tools/sourcehut pytest — 14 passed (verified no regression from prior SourceHut work)
• prek run --all-files passes
  • Partial: lychee hook fails due to missing MSVC linker on Windows (pre-existing, not caused by this PR). All other hooks pass. The spec-validate failures are also pre-existing (missing .claude/skills/magpie-* symlink targets unrelated to this change).

RFC-AI-0004 compliance

• HITL — all write paths (ticket create, ticket edit, ticket comment, commit) are CLI commands invoked by the calling skill; no autonomous mutations
• Sandbox — no network access; all reads are local SQLite queries or fossil CLI invocations against the local repository database
• Vendor neutrality — tools/fossil/ is a standalone adapter behind the existing capability contracts; no skill carries a Fossil assumption; the check-placeholders hook is unaffected (no placeholders in adapter code)
• Write-access discipline — no autonomous outbound messages; ticket/wiki/forum writes require explicit CLI invocation

Linked issues

Closes #604

Notes for reviewers (optional)

• Architecture choice: The bridge reads ticket metadata and forum posts via direct sqlite3 queries against the Fossil repository database (fast, offline, no network), but delegates write operations and artifact decompression to the fossil CLI binary. This avoids reimplementing Fossil's artifact format and hash verification while keeping reads instant.
• cat subcommand addition: The cat command was added to the abstract VCSBackend interface and implemented for all three shipping backends (Git via git show, Mercurial via hg cat, Fossil via fossil cat). This is a minor interface extension that benefits all backends.
• Forum artifact parsing: Fossil forum posts are stored as manifests with single-letter card prefixes (U for user, D for date, W for subject, I for in-reply-to, Z as payload separator). The parser in forum.py reconstructs thread hierarchies from these cards.

[onlyarnav]

I will fix the upcoming merge conflicts due to #677 and #670 after successful merge of either/both PR.
Meanwhile currently working in other changes required here referencing from other PRs to successfully implement the feature