chore(just): add a human entry surface for bot-maintenance offline modes

Summary

Adds a root justfile (pipeline's own dev surface, never shipped to consumers or baked into an image) wrapping the offline/self-test modes of two existing scripts:

• bot-maintenance-audit.py: --selftest, --validate-manifest, --assert-lane-armed
• renovate-fleet-audit.py: --selftest

Each recipe was previously only invocable as mise exec -- uv run scripts/<name>.py <flag>. just with no args lists recipes.

Deliberately excludes any live/credentialed mode: no recipe touches BOT_AUDIT_TOKEN or GITLAB_TOKEN, matching the constraint documented in both scripts' own docstrings. just is now pinned in mise.toml (just = "1.58.0"), same rationale as the existing uv pin.

CI is untouched: every job still calls the scripts directly.

Out of scope, noted as follow-up: lint-templates.py (offline, but already claimed by the unmerged feat/just-driven-recipes justfile) and posture-verify.py (offline-ness is data-dependent on consumer-declared evidence commands, not code-guaranteed).

Test plan

• just bot-maintenance-selftest, 41/41 cases pass
• just bot-maintenance-validate-manifest, passes against live bots.yaml (4 credentials declared: 3 managed, 1 watched)
• just bot-maintenance-assert-lane-armed, reports lane inert (expected, pre-mint)
• just renovate-fleet-selftest, 5/5 cases pass
• All four re-run after the rebase below, on the newer pinned uv

Two notes for the reviewer

Rebase resolution. This branch was rebased onto main before opening. The only conflict was mise.toml: main had bumped uv 0.12.1 to 0.12.3 via renovate/container-tool-pins while this branch carried the older value incidentally. Resolved by keeping main's uv = "0.12.3" and adding just = "1.58.0" alongside it. This branch never intended to change uv.

Doc comments are one line each, deliberately. just uses only the LAST comment line before a recipe as its description, so a wrapped comment block rendered three of the four recipes as fragments in just --list (# credential., # environment only -- no network, no credential.). Since just --list is the one output this file exists to produce, each recipe now carries a single self-contained doc line, with longer rationale moved above a blank line where just ignores it.

Merge-order dependency

origin/feat/just-driven-recipes also creates a root justfile from scratch (71 lines to this branch's 54), and main currently has no justfile at all, so a create/create conflict between the two is guaranteed in either order. Recommend landing this smaller branch first and rebasing that one over it. Recipe names here were deliberately chosen not to collide with it.