Make local-ci.sh install tools and mirror GitHub CI commands

## Objective

Make `local-ci.sh` faithfully replicate the GitHub CI quality gates and install missing local tools when needed.

## Current State

`local-ci.sh` currently runs fmt, build, clippy, nextest, and cargo-machete. The remote CI also runs or validates:

- zizmor
- memory-only build
- domain-layer purity grep
- cargo doc with `RUSTDOCFLAGS=-D warnings`
- doc tests
- cargo vet
- cargo deny/audit
- typos
- tombi
- markdownlint
- Helm rendering plus Trivy/KubeLinter scans
- yamlfmt
- OpenTelemetry collector config validation
- cargo llvm-cov

## Deliverables

- [ ] Inventory all commands from `.github/workflows/CI.yml`, `cargo_deny.yml`, and `crate_type.yml`.
- [ ] Add local tool bootstrap for missing CLIs where practical, without requiring root unless unavoidable.
- [ ] Provide fast/default and full/parity modes if the full remote CI is too heavy for every local run.
- [ ] Use the same flags and configs as CI.
- [ ] Document any checks that cannot be replicated locally and why.

## Acceptance Criteria

- [ ] `./local-ci.sh --full` runs the same command set as remote CI where local execution is practical.
- [ ] `./local-ci.sh` remains approachable for day-to-day use.
- [ ] Missing tools produce actionable install/bootstrap messages.
- [ ] The script exits non-zero on the same failures CI would catch.

## Verification

- [ ] Run default local CI mode.
- [ ] Run full local CI mode on a clean environment or documented dev image.