build: uv 工具链、检查命令与提交前检查

- pyproject：Python 3.12、ruff、pyright strict、pytest（live/gpu 标记）、import-linter；
  首条导入契约：cadx 不导入 torch、sam2（design 0001 第 7 条）
- Makefile：sync/fmt/test/check
- pre-commit：gitleaks、拦截 data/runs/reference/reference-pdf/models 与 .env、ruff format
- 空包 cadx 与一项导入测试，让 make check 能跑通

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pyproject.toml

@@ -0,0 +1,64 @@
+[project]
+name = "cadx"
+version = "0.0.0"
+description = "胰腺囊性肿瘤多模态会诊诊断的研究代码"
+requires-python = ">=3.12"
+dependencies = []
+
+[dependency-groups]
+dev = [
+    "ruff>=0.6",
+    "pyright>=1.1.380",
+    "pytest>=8.3",
+    "import-linter>=2.1",
+    "pre-commit>=4.0",
+]
+
+[build-system]
+requires = ["hatchling>=1.26"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/cadx"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+src = ["src", "tests", "scripts"]
+extend-exclude = ["research-wiki", "reference", "reference-pdf", "runs", "data"]
+
+[tool.ruff.lint]
+select = ["E", "W", "F", "I", "UP", "B", "BLE", "S", "SIM", "RUF"]
+# 允许注释和文档字符串里的中文全角标点。
+ignore = ["RUF001", "RUF002", "RUF003"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S101"]
+
+[tool.pyright]
+include = ["src", "tests", "scripts"]
+pythonVersion = "3.12"
+typeCheckingMode = "strict"
+venvPath = "."
+venv = ".venv"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "--strict-markers --import-mode=importlib"
+markers = [
+    "live: 真实模型调用，花钱，需要 .env 里的密钥",
+    "gpu: 需要 CUDA 显卡（MedSAM2 分割）",
+]
+
+# 导入边界。改契约先改 research-wiki/explanation/结构.md，再改这里；
+# 不靠 ignore_imports 让违规通过。规划中的契约见结构.md 第四节，模块落地时随任务书加入。
+[tool.importlinter]
+root_packages = ["cadx"]
+include_external_packages = true
+
+[[tool.importlinter.contracts]]
+# design 0001：torch 与 MedSAM2 只许出现在分割模块（模块落地时在这里放行 cadx.segment）。
+name = "torch 与 sam2 不进 cadx"
+type = "forbidden"
+source_modules = ["cadx"]
+forbidden_modules = ["torch", "sam2"]