PR06: split provider extras and verify clean distributions

[aniaisec]

Base installations currently pull both live-model SDKs even for deterministic replay. This change moves them into independent anthropic and gemini extras, with discovery combining both and dev retaining provider translation coverage. Selecting an unavailable SDK fails before UI launch with its installation command; scripted discovery, browser replay, HTTP/MCP, init, doctor and the no-key demo remain available in base.

Hatch now reads the version from cua.__version__, also exposed through cua --version. Adds project metadata, changelog, Python 3.11 development constraints and packaging guidance. CI builds wheel/sdist archives and checks fresh, non-editable base/provider/vision/Windows installations outside the checkout with import-path overrides removed.

Validation

• Windows, Python 3.11.9: 1006 passed, 1 skipped, 119 deselected in the complete non-browser/non-desktop suite. The skip requires Windows symlink privileges.
• All seven fresh installation combinations passed: base wheel, base rebuilt from sdist, Anthropic, Gemini, discovery, vision and Windows dependency/adapter imports. Base wheel and sdist demos both completed all seven stages with zero replay model calls and exactly one consented commit.
• Wheel/sdist resource and metadata checks passed; final wheel contents match the installations tested. Every installed combination checked console/module help and version, all starter templates, doctor JSON and mock HTML. SDK constructors used synthetic keys with network connections blocked.
• Ruff lint/format, diff checks and strict Linux/Windows mypy targets passed (150 source files). Focused Python 3.14.5 provider/doctor/packaging checks also passed.
• Self-review fixes cover Hatch's expanded combined-extra metadata, the Windows class descriptor check, system-temporary scratch work and uncached sdist rebuilding. Regression coverage rejects SDKs in base, missing extras/resources, version disagreement and packaged signing keys.

Interactive Windows UIA and paid model requests were not exercised. Hosted Linux and Windows CI will provide platform checks on this PR. Distribution validation does not publish a release.