Add black-box downstream consumer probes and compatibility CI

[GeneralPawz]

What

Build representative consumers outside the workspace and run them as release gates. Cover narrow Rust leaf-crate use, the Rust application facade, plain C, and C++ through CMake using only documented public artifacts and APIs.

Why now

Workspace tests can pass while published manifests, generated headers, link metadata, feature closures, or ABI symbols are unusable. The v0.4 milestone needs evidence from the same boundary real applications will cross.

Definition of done

• Every probe is copied to a clean temporary directory before dependency resolution and build.
• Rust probes cover the documented minimal closures and the supported application facade workflow.
• C and C++ probes configure, compile, link, execute success paths, and observe a typed refusal path.
• Linux, macOS, and Windows run the relevant probes against release-mode artifacts.
• Probes reject workspace-relative paths, unpublished internal packages, unversioned ABI symbols, and undeclared runtime libraries.
• A release-candidate job runs the probes against the exact packaged artifacts, not a sibling checkout.
• Mutations removing a required symbol, feature, header, or package prove each gate can fail.

Area

architecture

Effort

High