Wire services/grader into CI and the local stack

[ckrough]

Follow-up from #293 (T1 grader scaffold).

services/grader/ ships with its own passing gates, but nothing runs them automatically:

• Add a grader job to .github/workflows/ci.yml mirroring the retriever job (ruff check, ruff format --check, bandit -r src/, mypy src/, pytest).
• Add grader to the repo's bound daedalus test/lint commands in .daedalus/config.json.
• Wire grader into the one-command local stack: root Makefile targets and docs/local-development.md (host port 8003).

Out of #293's stated scope (workflow edits are hook-blocked in the pipeline worktree; .daedalus/ is gitignored), so it was split out rather than smuggled into that PR.