feat: add observation-bound model structure and q8 decoding

[forkwright]

Scope

Continue #150 with original CPU-only native-model foundations. This does not close #150 or #46.

• Parse and decode one finite-scale GGML Q8_0 block. The quant crate owns its layout; loader inspection derives that geometry without admitting tensor payload decoding.
• Construct a private-field, observation-bound Qwen35 structural profile. Exact typed metadata derives the tensor roles, shapes and attention cadence; main blocks and optional terminal NextN remain separate. Missing, extra, duplicate, wrongly shaped and excessive inventories fail closed. This first domain refuses recurrent-layer overrides and more than one NextN block.
• Add a small HIP-free structural witness that reports only facts from its profile's own observation. The environment variable is not isolation; routine use requires the existing one-file read-only GPU-denied runner.
• Refresh authored crate and repository descriptions with these narrow capability boundaries.

The small positive GGUF fixture uses nondegenerate dimensions and actual observation construction. No caller-built Inspection or deserialization path can construct the profile. Q8_0 errors retain PartialEq/Eq traits; SNAFU Location now participates in equality.

Evidence

• Combined GPU-denied, locked workspace tests, strict all-target Clippy, formatting, repository guards, and release quant/loader/decoders tests passed.
• Follow-up release decoders/all-target tests, debug and release strict Clippy, optimized witness build, and missing-input exit-64 smoke passed.
• Minimal bin and decoders normal/build graphs are HIP-free; the optimized witness links only the ordinary C/runtime libraries.
• Independent static review cleared Q8_0 and the structural authority after corrective fixtures and override refusal.
• The exact pinned Qwen3.8-27B UD-Q5_K_XL artifact passed the optimized witness under the reviewed single-RO-input denied runner: 20,876,938,144 bytes; SHA-256 8601193d3d5760c37fb8ce1b43afebc69df5fb24e1fbc5a547c32e2200305276; all 866 tensor roles/shapes; 65 stored blocks = 64 main + 1 NextN. This is an observed-byte/structural result, not model execution.

Boundaries

No model forward pass, whole-tensor Q8 load, mixed-text quant decoding, tokenizer/template parity, provenance admission, derived VRAM budget, service/routing change or GPU access. Observations are not atomic snapshots. The deliberately narrow profile can reject other upstream-valid layouts; it does not claim general Qwen-family support. Upstream format/model facts were read at pinned sources, not carried as implementation.