feat: defer PAC/.NET/az/Git installation to on-demand in specialist skills

## Problem

dv-connect front-loads ALL tool installations (Python, Node, DV CLI, PAC, .NET SDK, Azure CLI, Git) and both auth profiles (DV CLI + PAC) on every first-time setup, regardless of what the user's task actually needs. This adds 1-2 minutes of install time for tools that only 2 of 7 skills use.

## Evidence

- PAC CLI + .NET SDK (~1.9GB) are needed ONLY by dv-solution and dv-admin
- Azure CLI is needed ONLY for service-principal app registration (rare)
- Git is needed ONLY for solution pack/unpack
- pac auth create is needed ONLY by dv-solution/dv-admin
- A user who only does data queries or metadata inspection pays the full tax

Eval transcripts show 3-5 min first-time setup where ~60% of the time is spent installing tools the immediate task does not require.

## Proposal

Split Step 1 into essential and deferred tiers:

**Essential (always, ~1-2 min):** Python + pip deps, Node.js + DV CLI, dataverse auth create, MCP registration, .env + scripts/auth.py

**Deferred (on-demand, installed when the specialist skill first loads):**
- dv-solution loads: check PAC + .NET + Git, install if missing, then pac auth create
- dv-admin loads: check PAC + .NET, install if missing
- Service principal setup: check az CLI, install if missing

Each deferred skill would have a prerequisites check at its top (similar to how dv-connect Step 0 works today) that installs only what it needs.

## Impact

- First-time dv-connect drops from ~3-5 min to ~1-2 min
- Users who never touch solutions or admin never install PAC/.NET/az
- No capability loss -- tools are installed the moment they are needed, not before

## Non-goals

- This does NOT change the MCP-first routing (separate change)
- This does NOT change the auth chain in auth.py
- This does NOT affect persistent-workspace users who already ran dv-connect

Start with dv-connect Step 1 and compare its existing Step 0 prerequisites check, then trace the dv-solution, dv-admin, and service-principal setup entry points. Keep the auth chain in auth.py and MCP-first routing unchanged; done means essential setup omits deferred tools and each specialist flow installs and authenticates only its own prerequisites when needed.

Written by the indexing model from the issue text.