feat(mcp): embed Python engine and extract to user cache

U2 of the Claude Desktop .mcpb bundle plan.

- internal/engine/embed.go embeds the vendored Python tree at build time
  via //go:embed all:vendored. The engine package owns the embed because
  Go's directive cannot reach outside its own package directory; sync and
  gitignore paths are updated to match (internal/engine/vendored/ in
  place of mcp/vendored/).
- internal/engine/extract.go materializes the embed into
  <cache>/last30days-pp-mcp/<version>/ with a .version sentinel that
  short-circuits re-extraction. Atomic rename from a .tmp sibling means
  a partial extraction can never be mistaken for complete. Concurrent
  first-call extractions serialize behind a per-cache-dir sync.Once.
- EnsureUserCache honors a LAST30DAYS_CACHE_DIR env override for
  locked-down filesystems; the override is named in extract errors.
- internal/engine/extract_test.go covers happy path, sentinel skip,
  version bump, 10-goroutine race, empty-version rejection, unwritable
  cache parent, and the env override (7 tests, all passing).
- A tracked vendored/.gitkeep anchors the embed path so the directive
  matches even before scripts/sync-engine.sh runs.

.gitignore

@@ -28,7 +28,11 @@ htmlcov/
 
 # Go MCP bundle build outputs - source of truth for vendored/ stays under
 # skills/last30days/scripts/; build/ holds cross-compiled binaries + .mcpb files.
-/mcp/vendored/
+# vendored/ lives inside the engine package because //go:embed cannot reach
+# outside its own package directory; the .gitkeep anchor stays tracked so
+# the embed pattern always finds a match even before sync-engine runs.
+/mcp/internal/engine/vendored/*
+!/mcp/internal/engine/vendored/.gitkeep
 /mcp/build/
 
 # Internal planning docs (ce:plan output) — keep local, don't publish