feat(gkit): add read-only HubSpot provider

[Deniffer001]

Summary

• add a profile-bound, read-only HubSpot provider using the existing gkit capability and execution contract
• expose seven reviewed growth-analysis reads across CRM metadata, objects/search, associations, events, pipelines, and owners
• enforce object/property allowlists, pagination/search bounds, safe error mapping, artifact-only result handling, and secret redaction
• document HubSpot API 2026-03 choices and PII boundaries
• bump the release version to 0.1.3

Interface consistency

HubSpot uses the same profile, doctor, offline discovery/describe, <provider> api call --operation-id, dry-run, no-replace artifact, response envelope, request ID, timeout/cancellation, and non-zero exit conventions as the existing providers. It calls HubSpot REST directly and does not depend on @hubspot/cli or hs.

Verification

• bun install --frozen-lockfile
• bun run check-types
• bun run test (26 files, 169 tests)
• bun run eval (40/40)
• bun run --cwd packages/gkit generate:hubspot:check
• bun run verify:package (gkit-0.1.3.tgz)
• release preflight for v0.1.3
• git diff --check