build!: bump MSRV to 1.96.0 and migrate assert! matches! to assert_matches!

[bug-ops]

Summary

• Raise rust-version from 1.93.0 to 1.96.0 to unlock assert_matches!/debug_assert_matches! (stable since 1.96) and core::hint::cold_path() (stable since 1.95). 1.96.0 is the actual minimum needed — the two APIs used don't require 1.97.
• Migrate 151 assert!(matches!(value, Pattern)) call sites in exarch-core src/tests to assert_matches! for Debug-based failure diagnostics. 4 sites in formats/zip.rs stay as assert!(matches!(..)) (scrutinee isn't Debug); 7 sites in tests/property_tests.rs stay as prop_assert!(matches!(..)) (proptest has no assert_matches! equivalent).
• Apply cold_path() to the OPT-C003 hot/cold-path branches in QuotaTracker::record_file/record_file_checked (security/quota.rs).
• Update every MSRV reference across Cargo.toml, CI, clippy.toml, READMEs, CONTRIBUTING.md, the exarch-cli skill doc, and 13 previously stale spec references (including two normative items, NFR-010/SC-008 in specs/001-exarch-system/spec.md).
• CHANGELOG.md updated under [Unreleased] with a BREAKING:-flagged entry.

Context

Closes #401

Issue #401 was filed as a P4/backlog/research feasibility note estimating ~66 candidate call sites and recommending deferral rather than a dedicated PR. The scope here was explicitly confirmed before implementation. The real count of eligible sites turned out to be 151, not 66 — the original estimate undercounted multi-line-formatted assert!(...)/matches!(...) calls.

Breaking change

Minimum supported Rust version is now 1.96.0 (previously 1.93.0). Downstream consumers on an older toolchain must upgrade before taking this release.

Test plan

• cargo +nightly fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run --workspace --all-features --exclude exarch-python --exclude exarch-node (966 passed)
• cargo test --doc --workspace --all-features for exarch-core/exarch-cli/exarch-node (exarch-python doc-test hits a known pre-existing PyO3 linker issue in local sandboxes, unrelated to this change and untouched by it)
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features for exarch-core/exarch-cli/exarch-node
• rustup run 1.96.0 cargo check --workspace --all-features --tests --ignore-rust-version — confirms the code actually compiles on the new MSRV floor
• Verified zero remaining unmigrated assert!(matches!(...)) sites outside the two documented exceptions
• Adversarial critique pass and independent code review, both passed