fix(packaging): keep runtime integration install slim

[AdeGneus]

What does this PR do?

Keeps the public ori.integration rule-evaluation install path slim for product/demo consumers like ori-energy.

Before this change, installing ori-runtime pulled the full runtime dependency surface: MQTT, SMS/WhatsApp providers, OPC-UA, HTTP adapters, crypto transports, psutil, and other hardware/runtime packages. That made the ori-energy FastAPI demo install the entire edge runtime stack just to call the public rule-evaluation boundary.

This PR changes package metadata so:

• base ori-runtime installs only PyYAML, which is what ori.integration needs to load bundled skill YAML and evaluate rules;
• ori-runtime[eval] is an explicit stable install target for demo/product consumers;
• ori-runtime[runtime] carries transport, provider, HAL, and security runtime dependencies for actual edge runtime installs;
• ori-runtime[all] remains available for full local/dev installs;
• the release-wheel smoke test now fails if heavy runtime dependencies leak back into the base wheel metadata.

The runtime source package is still one package. This is a dependency-boundary fix, not a code split.

Type of change

• fix — bug fix / packaging correction
• docs — documentation update
• test — tests added
• feat — new feature
• refactor — no behavior change

Checklist

• Tests pass locally
• Ruff/pre-commit passes
• Runtime boundary mypy gate passes
• Release wheel smoke test passes
• Capability matrix updated
• No secrets or deployment credentials added

Validation

bash scripts/typecheck-boundaries.sh
.venv/bin/ruff check tests/test_packaging_metadata.py
.venv/bin/pytest tests/test_packaging_metadata.py tests/test_integration_rule_evaluation.py -q
.venv/bin/pre-commit run --all-files
ORI_PYTHON=.venv/bin/python bash scripts/smoke-release-wheel.sh
.venv/bin/pytest tests/ -q -m "not hardware"

Results:

• focused packaging/integration tests: 21 passed
• full non-hardware suite: 1482 passed, 8 skipped
• release wheel smoke: passed, including base wheel metadata check and installed ori.integration Tier D evaluation

Downstream impact

After this merges, ori-energy should pin the runtime dependency as:

"ori-runtime[eval] @ git+https://github.com/ori-platform/ori-runtime.git@<commit-or-tag>"

This avoids pulling MQTT/SMS/provider/hardware dependencies into the demo API while still using the real runtime rule engine.