fix(cli): defer graph initialization

[deepujain]

Summary

• Defer loading the compiled workflow graph until a caller first uses graph.
• Keep CLI help and version paths independent of analyzer discovery, so they return without missing-credential warnings.
• Preserve the existing graph.invoke / graph.ainvoke interface through a thread-safe lightweight proxy.
• Add subprocess regression coverage that clears provider credentials and verifies --help stays quiet.

Validation

• uv run pytest tests/unit/test_cli.py -q — 102 passed.
• uv run pytest -m 'not integration and not provider' tests/ -q — 2,856 passed, 13 skipped, 38 deselected, 4 xfailed.
• uv run ruff check src tests — passed.
• uv run ruff format --check src tests — 194 files already formatted.
• uv run skillspector scan tests/fixtures/safe_skill --no-llm --format json — completed successfully with a 100% complete SAFE report; first graph use still emitted unavailable-analyzer warnings.
• uv run skillspector --help — returned clean help without analyzer warnings; observed startup fell from roughly 17 seconds to roughly 1.3 seconds in the same worktree.
• git diff --check — passed.

Risk

• Low-to-medium: graph creation moves from package/CLI import time to first use, but the compiled graph implementation and scan behavior are unchanged.
• The proxy uses a lock and double-check so concurrent first callers compile the graph once.
• Direct imports from skillspector.graph retain their existing eager behavior; the documented package export and CLI use the lazy proxy.

Fixes #435