fix(cli): defer graph initialization

[deepujain]

Summary

• Defer loading the compiled workflow graph until a caller first uses graph.
• Keep CLI help and version paths independent of analyzer discovery, so they return without missing-credential warnings.
• Preserve the existing graph.invoke / graph.ainvoke interface through a thread-safe lightweight proxy.
• Add subprocess regression coverage that clears provider credentials and verifies --help stays quiet.

Validation

• uv run pytest tests/unit/test_cli.py -q - 102 passed.
• uv run pytest -m 'not integration and not provider' tests/ -q - 2,856 passed, 13 skipped, 38 deselected, 4 xfailed.
• uv run ruff check src tests - passed.
• uv run ruff format --check src tests - 194 files already formatted.
• uv run skillspector scan tests/fixtures/safe_skill --no-llm --format json - completed successfully with a 100% complete SAFE report; first graph use still emitted unavailable-analyzer warnings.
• uv run skillspector --help - returned clean help without analyzer warnings; observed startup fell from roughly 17 seconds to roughly 1.3 seconds in the same worktree.
• git diff --check - passed.

Risk

• Low-to-medium: graph creation moves from package/CLI import time to first use, but the compiled graph implementation and scan behavior are unchanged.
• The proxy uses a lock and double-check so concurrent first callers compile the graph once.
• Direct imports from skillspector.graph retain their existing eager behavior; the documented package export and CLI use the lazy proxy.

Fixes #435

[rng1995]

[SkillSpector Review]

Help now avoids eager analyzer initialization, but the lazy load makes the documented package-level graph API import-order dependent: after the first load, later imports receive the submodule rather than an invokable graph. Please preserve a stable export and cover the post-load re-import case. All required checks are green.

[deepujain]

Addressed the import-order regression with the package-level lazy export and test, then fixed the current-head Ruff finding. The lint-fix CI run is now pending.

[deepujain]

The rerun exposed two Ruff format-only changes already on this PR head. I applied the repository-pinned formatter output, verified Ruff check/format plus syntax checks locally, and pushed the follow-up; CI is rerunning.

[deepujain]

Added tests/unit/test_graph_proxy.py covering post-load re-import stability (rng1995 review). Pushed 3e6cdbf; CI rerunning.

[deepujain]

Scheduled sweep: pushed f9e2fc7 fixing test-unit failure on test_package_graph_export_survives_submodule_load (restore package-level LazyGraph binding after submodule import). CI rerunning.

[deepujain]

Re-review request on head e3ca50a9:

The P1 graph-export concern is addressed in graph_proxy.py: after the compiled submodule import, we restore the package-level LazyGraph on both skillspector.graph and sys.modules["skillspector"].graph.

Regression: tests/unit/test_graph_proxy.py::test_package_graph_export_survives_submodule_load reproduces the import-order failure and asserts skillspector.graph stays invokable after the submodule load path.

CI is green on this head. Please re-review when convenient.