Lightweight headless CI distribution (no MCP, LSP, interactive UI)

## Feedback source
External user feedback (travel multi-agent workshop team).

## Problem
The current single-binary distribution bundles everything: interactive shell, MCP server, LSP, brokered auth, OpenTelemetry, ARM management. For CI/CD use cases (data seeding, CRUD, queries, integration test validation), most of this is unnecessary weight and attack surface.

## Proposed solution
Ship a **separate lightweight, headless CI distribution** with:
- Predictable exit codes (stable contract)
- JSON output mode (\--output json\)
- Workload-identity authentication (federated credentials, no interactive browser)
- Core commands: import, query, assert, CRUD
- **No** MCP, LSP, brokered authentication, or interactive UI

## Implementation options (in priority order)
1. **Same .NET codebase with trimming/Native AOT** — feature-flag the build to exclude MCP/LSP/interactive modules, use .NET publish trimming or NativeAOT for a smaller binary
2. **Go or Rust reimplementation** of the CI-only subset — smallest possible binary, no runtime dependency

Splitting the feature set is more important than changing languages.

## Relationship to other issues
- Complements #155 (A1 — non-interactive output contract)
- Addresses size concern in #174
- Pairs with CI/CD documentation (#TBD)

## Acceptance criteria
- [x] CI distribution is < 15 MB compressed
- [x] Supports workload-identity auth (OIDC federated credentials)
- [x] Stable exit-code contract documented
- [x] JSON output for all commands
- [ ] No dependency on interactive terminal or browser

未指定文件或测试；首先检查当前的单二进制分发及其构建配置，然后跟踪 import、query、assert 和 CRUD 的入口点。检查当前如何处理 JSON 输出、退出代码和 workload identity 身份验证。完成的标准是：提供一个小于 15 MB 的压缩 CI 分发包，既不需要交互式终端，也不需要浏览器。

由索引模型根据 Issue 内容生成。