v0.3.0 — non_exhaustive sweeps, Debug impl, honesty debt closure

Closes the v0.2.0 semver/honesty debt flagged in the post-v0.2.0 self-reviews. Breaking only because of #[non_exhaustive] on BufferStats and SegmentConfig — downstream struct-literal construction must switch to Default::default() + field reassignment.

Highlights:

• Debug impl for SegmentBuffer<T> (T: Debug not required)
• CipherError::with_source doc-test
• Display snapshot tests for every error variant
• benches/bench_stats.rs proving stats() (~12 ns) ≈ 2.5× cheaper than 3 individual accessors (~31 ns)
• Controlled git worktree baseline: docs/perf/2026-07-19_v0.1.0-vs-v0.2.0.md (append +30-65% on small batches, recover -40-45%)
• AGENTS.md "Verification discipline" section: 4 hard rules after 3 sessions produced false closing claims
• rust-overlay integration in flake.nix with devShells.msrv (1.85) and devShells.fuzz (nightly)
• Loom concurrency test (tests/loom.rs) covering the in-memory append + stats() snapshot path
• Both fuzz targets verified locally (60s each, 1.1M+ runs combined, zero crashes)

See CHANGELOG for the full change history.