Document base-cli provider policy and add source-checkout compatibility CI

[codeforester]

Summary

Document how base-demo consumes base-cli and add an explicit compatibility job for a peer source checkout.

Scope

• Document that the normal base-demo path uses the locked base-cli==0.4.1 package.
• Document that Base launchers may opt into a peer source checkout through BASE_CLI_SOURCE_DIR.
• Add CI coverage that checks Base and base-demo against a peer base-cli source checkout without changing the reproducible wheel-based job.

Acceptance criteria

• README explains the provider-resolution policy and reproducibility boundary.
• CI keeps the existing locked-package path unchanged.
• A separate CI job checks out base-cli, sets BASE_CLI_SOURCE_DIR, and verifies BASE_CLI_SOURCE=explicit through the base-demo Python command.
• Repository validation checks the new documentation and workflow contract.