refactor(tickets): migrate GitHub mechanics to Python

[BjRo]

Why

Closes #178. The GitHub Issues facade depended on Bash and Unix utilities for substantial parsing and provider mechanics, preventing native Windows execution.

What changed

Replace bin/ticket with a dependency-free, UV-managed Python package and the frozen darrow-ticket entrypoint. Keep all ten operations, compact reports, exit codes, and skill authority while simplifying argument handling, validation, JSON decoding, relation operations, and temporary-file ownership.

Preserve origin host/repository binding, exact-label safeguards, foreign-parent refusals, complete dependency pagination, read-before-write checks, and honest partial-write reports. Remove the Bash launcher and replace its regression suite with Python contract/property tests; update all four skills and their provider fixtures, documentation, inventory, and matching manifests to version 0.4.0. Add Python 3.10–3.13 Windows checks and fresh copied-plugin jobs on Linux, macOS, and Windows.

Route Claude ticket requests before prerequisite judgments through a static, nonmutating SessionStart context in the same package. Clarify ambiguous read activation, preserve imperative ticket text as quoted data, and copy compact list records without reformatting them into prose. Fix the shared Claude observer to recognize native plugin-command expansion, bound to the mounted namespace, complete body, arguments, and session, while preserving valid direct Skill-event evidence.

Verification

• bun run check:python: passed repository-wide; the ticket package has 144 passing tests and 100% statement / 100% branch coverage, with strict mypy and Ruff complexity gates.
• 367 differential input-validation cases match the former Bash implementation.
• uv run --quiet --frozen --no-dev --project plugins/capability/darrow-tickets-github/backend python plugins/capability/darrow-tickets-github/backend/tests/fresh_install.py: passed locally on macOS, with gh available and provider operations mocked.
• All 27 ticket cases passed both task and activation checks on Claude (claude-sonnet-5, medium) and Codex (gpt-5.6-terra, medium): 54 native trials, one trial per case/host, 80% configured threshold. Affected cases were rerun after fixes; all 27 fixtures also passed dry validation.
• Final-commit Python CI passed on Linux/macOS Python 3.10–3.13, all four native Windows versions, and fresh copied-plugin checks on all three operating systems. Documentation CI passed.
• 97 Claude adapter/activation regression tests passed, including exact native plugin identity and direct-event fallback.
• bun run lint, lint:shell, lint:ts, typecheck, check:decisions, and check:docs: passed; all four skills passed inspection and the Claude plugin manifest validated.
• The required independent fresh-context artifact challenge and focused delta reviews are complete. One observer fallback finding was fixed and regression-tested; no unresolved material findings remain. The Bash interpreter matrix is not applicable to the removed runtime and replaced shell suite.

Review notes

The old script path is intentionally removed: callers use uv run --quiet --frozen --no-dev --project <plugin-root>/backend darrow-ticket. No compatibility shim or shared plugin runtime remains. Tests never mutate live GitHub state. Fresh-copy checks run Git natively, require installed gh, and mock provider operations; they do not certify live GitHub API behavior. Single-trial evals are bounded acceptance evidence, not a reliability estimate.

The Windows literal-argument test now emits UTF-8 bytes explicitly. Three list-output assertions normalize only the state/title separator spacing permitted by TM-L3; all visible content and line order remain exact. The explicit incomplete-read failure was an observer defect: Claude had already expanded the plugin command before its first turn. Native-expansion regression tests cover plugin identity and preserve the existing Skill-event path.

The final CI run initially encountered a SQLite database-lock race in an unchanged observability concurrency test on macOS/Python 3.10. A failed-jobs CI rerun passed; this PR does not claim to fix that intermittent race.

The conversation-reference eval previously fabricated ticket-token: #12; its fixture and expectation now use the documented authoritative numeric token 12.

Checklist

• I have read and followed CONTRIBUTING.md, including the contribution
  licensing terms.
• I added or updated the applicable invariant before implementation, or
  this change does not affect a capability invariant.
• I added or updated colocated evals, or this change does not affect skill
  behavior.
• I confirmed that each changed plugin remains self-contained, or this
  change does not affect plugin content.
• I ran bun run check:python, or this change does not affect registered
  Python packages or their repository quality infrastructure.