refactor: bind meme to narrow plugin capabilities

[kachofugetsu09]

Why

Meme should consume only the capabilities it owns: Skills, UI Slots, and phase-owned turn events. The transitional combined asset service and centralized lifecycle event imports couple unrelated concerns and make external plugin imports fragile.

What

• replaces the combined plugin-assets dependency with independent core.skills and core.ui_slots services
• binds prompt and answer behavior to phase-owned safe event keys
• keeps the v2 MemePlugin as the behavioral oracle for this migration PR
• verifies real PluginManager load, topology, dashboard/skill contributions, teardown, and Citation plus Meme ordering
• pins Core 435bbaf1e6f777951b4622702d7a7796665ed67a, Citation b2941ee472d73ac40547dde8f16c98f0dfbbcdba, and plugin-contracts 4dd69dd621e029e51e99aa428443fa3a4ec1f6cf in CI

Verification

• 9 passed in cross-repository parity tests
• Plugin API v3 static contract passed
• basedpyright: 0 errors, 0 warnings
• compileall and git diff --check passed

Scope

No Meme domain logic, workspace data, external effects, or persistent state is changed. This PR remains stacked on the v3 candidate so the next cleanup PR can remove the v2 shell separately.

[kachofugetsu09]

此中间层依赖已经退役的 core.skills/core.ui_slots 与 agent.turn_events.*。当前 package declarations、workspace root 和 lifecycle event 合同已直接进入更新后的 #2，v2 物理删除由重新叠放的 #3 完成，因此本 PR 被 #2 + #3 取代。旧 head 由 backup/meme-v3-capabilities-before-current-core-20260816 保留。