feat(clio): committed live-probe runner for the Practice Management spec

Regenerates the lost scratchpad probe script, this time in the repo. Answers
docs/PRACTICE_MANAGEMENT_SPEC.md's four open questions against the live EU
tenant with a stored connection: offset continuation on /matters.json (Q1),
the corrected billable_matters selector (Q2), billed-entry write restrictions
(Q3, write probe), and the corrected contacts selector (Q4) - plus the five
remaining reads the Matters seam depends on, so sign-off is not granted to
calls that were never exercised live.

Safety rails are structural, not promised:
- the Supabase handle is a proxy that throws on insert/update/upsert/delete/
  rpc, so the client's self-healing paths (refresh persistence, dead-grant
  prune) can never rewrite or delete a production connection row - they are
  surfaced instead;
- probes 1-9 can only call probeGet, which cannot express a method or a body;
- probe 10 needs BOTH --write-probe and CLIO_PROBE_TEST_MATTER_ID, creates one
  non-billable entry, answers the billed question with a NO-OP patch (never a
  destructive delete of billed time), and cleans up in a finally with honest
  reporting of anything left behind;
- sequential requests, small pages, and an abort after two consecutive 429s
  keep the run inside the 50 req/min budget shared with production.

A decryption failure is detected and explained (USER_API_KEYS_ENCRYPTION_SECRET
must match Fly) rather than surfacing as "not connected", and results record
shapes - field presence, counts, statuses - never client data.

The Matters seam's selector constants are exported so the probes test the exact
shipped strings rather than copies that could drift.

Verified: npx tsc --noEmit clean; tsc -p tsconfig.scripts.json clean; prettier
clean; 180 lib/clio tests pass; --dry-run walks all ten probes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>