feat: recover read-only static inspection protocol

[ORESoftware]

Recovery scope

Recover exact local commit fbb1e8bb1bf840bb45f83e1c2eb4cf1de39d4c3b, which existed only in a Codex worktree and saved patch after publication was previously blocked.

The commit adds a read-only zed inspect --workspace PATH --json implementation, static manifest/lock/materialization/Git/mise/Nix findings, structured recommendations, explicit network opt-in, documentation, and tests matching zed-cli issues #191 and #192.

Validation

• git diff --check passed.
• cargo fmt --all -- --check passed.
• The introduced diff was scanned for common credential/private-key patterns. Matches were variable or documentation names such as token; no credential value or private key was found.
• The originating audit recorded its focused behavior tests, but current-main CI is required before semantic promotion.

Reconciliation boundary

This is a draft recovery candidate based on bf1dc05e05900748a44ee02e7c507fd65bab4c7a. Current main has evolved substantially, and another saved worktree implements a competing command/schema shape. Preserve this exact work for semantic reconciliation; do not merge or resolve conflicts mechanically.

Refs #191 and #192.

[linear-code]

DEN-2175