[codex] Add Jaffle Shop DuckDB parse gate

[sabino]

Summary

• add a developer-side Jaffle Shop DuckDB parse gate that clones a pinned public ref into a temp directory and runs the Zig dxt binary
• validate the emitted M1 manifest schema slice, expected Jaffle resource shape, refs/dependency maps, configs, and representative ls selectors
• update README and PLAN to mark the scripted public-fixture gate as complete while keeping remaining M1/M1A gates explicit

Validation

• zig build --cache-dir /tmp/dxt-zig-cache --global-cache-dir /tmp/dxt-zig-global-cache
• zig build test --cache-dir /tmp/dxt-zig-cache --global-cache-dir /tmp/dxt-zig-global-cache
• pytest -q
• python scripts/check_jaffle_shop_duckdb_parse.py --no-build
• python scripts/check_runtime_boundary.py
• python scripts/check_public_safety.py
• git diff --check

Review

• subagent review found no blocking issues; follow-up findings were addressed
• codex exec review found no blocking issues