v2: Move Reminders reads to EventKit and define the action boundary

[jmcte]

Problem / intent

Reminders currently reads private Core Data schemas. remindctl shows that public EventKit can provide a more stable, permission-scoped interface and normal iCloud synchronization, including optional actions. The project must improve reads without silently crossing its current read-only boundary.

Acceptance criteria

• Use EventKit as the primary provider for lists and reminders with explicit authorization states and bounded results.
• Preserve compatible read-only CLI behavior and clearly mark fields/private smart-list concepts that EventKit cannot provide.
• Keep the private store only as an explicitly degraded, version-checked fallback.
• Update permissions doctor for Reminders authorization rather than treating every failure as Full Disk Access.
• Record an ADR for a future opt-in actions reminders namespace, including dry-run, confirmation, audit, and rollback limits.
• Do not implement mutations in this issue.
• Add framework-boundary tests and a permission-safe live smoke path.

Dependencies

• Depends on v2: Define a versioned provider capability manifest #89; archive integration depends on the resumable archive issue.
• v2 follow-up to closed Reminders issues Add Reminders inventory command #24 and Extend reminders with smart-list filters (flagged, today, scheduled, assigned) #69.