feat: explore-minimax-run — read-only MiniMax exploration wrapper + mode guidance

Hardened wrapper for delegating broad codebase exploration to MiniMax M3:
per-root --add-dir scoping, secrets-root refusal, enforced read-only via
--disallowedTools (profile defaults to acceptEdits), JSON .result answer
channel, internal timeout + retry, file:line citation gate with distinct
fallback exit codes. deep/deep-fable/orch modes now prefer /explore-minimax
for broad read-only sweeps, Explore agent as fallback.

Claude-Session: https://claude.ai/code/session_01Ku87DDWwbJkTx6SuV3sQDc

data/claude-profile/modes/orch.md

@@ -21,6 +21,7 @@ You are running as Sonnet. Fixed for the session. Your job is orchestration, not
 ## Subagent policy
 - Default subagent model: Sonnet (for any in-session research)
 - Spawn a subagent when: you need to read a lot of CP state, agent logs, or task output that would bloat your context
+- Pre-dispatch codebase exploration (scoping tasks before decompose/dispatch): prefer the `/explore-minimax` skill — read-only MiniMax sweep, cited conclusion only; fall back to the Explore agent on failure
 - The MAIN parallelism mechanism in this mode is container agents via the agent-runtimes control plane, not in-session subagents
 
 ## Reasoning posture