Release mechanics: per-build mangle-seed header, Starlark hash ports, leaner archive

[helly25]

Fixes release structure, handling, and mechanics. Three related pieces:

1. Mangle-seed header: generate per build, stop committing it

Release version-bump PRs failed CI (e.g. #252). The mangle-seed constant is
version-derived, and the checked-in non-Bazel fallback
internal/hash_mangle_seed.h.in baked that constant in, so every version bump
made it stale and broke hash_mangle_seed_default_test.

The root cause was structural: .h.in was a pre-rendered copy of the header
(the real template lived in the .bzl), carried a version-derived value, and had
to be regenerated and re-committed on every bump.

Fix - generate the header per build and never commit it:

• Removed internal/hash_mangle_seed.h.in and hash_mangle_seed_default_test.
• hash_mangle.h now includes the generated hash_mangle_seed_gen.h directly; a
  missing one is a hard #error (not a silent fallback). clangd falls back to a
  stable constant under -DIS_CLANGD purely so the editor can parse this
  low-level header.
• A version bump no longer needs a committed regeneration, and the
  --//mbo/hash:mangle_seed / --//mbo/hash:mangle_seed_buckets flags are
  unaffected (the header is still generated per build).

2. dumbo/fnv1a in Starlark, verified against the C++ prime

• Switched the version/seed fold from FNV-1a to the in-house dumbo hash
  (SMHasher3-proven; fnv1a is not).
• Added Starlark ports of dumbo and fnv1a in //mbo/hash:hash.bzl (public
  hash struct), kept byte-for-byte identical to the C++ prime and verified
  against it by hash_bzl_vs_cpp_dumbo_test / hash_bzl_vs_cpp_fnv1a_test.
• Added //mbo/hash:hash_tool, a minimal <algo> [<data>] hash CLI (plain
  GetHash64, no mangle) that doubles as the C++ reference for that verification.
• mbo/hash/README.md: added a Starlark column + a Starlark API snippet; the
  overview table is now PASS/FAIL only (exact SMHasher3 scores stay in the
  Results table).

3. Leaner release archive

release_prep.sh now drops dev-only files from the released tarball via
export-ignore, so it carries only what a consumer needs to build the library:

• Added to EXCLUDES: mbo/hash/measurements (dev/benchmark data, already
  .bazelignored), .trunk (linter orchestration), .gitattributes,
  .gitignore (git metadata, dead in a tarball).
• Deliberately kept: bazelmod (a useful template for downstream libs),
  .clang-format (mope formats its generated output with it), the other
  lint/format configs, and compile_commands-update.sh (a courtesy for
  consumers).

4. Trimmed and tightened CI (31 -> 19 test jobs, all gating)

• Made test-clang gating (was continue-on-error), so the hermetic-clang
  coverage actually blocks via the done gate.
• Removed the informational benchmark job - it never gated, did no baseline
  comparison, and produced noisy shared-runner artifacts nothing consumed;
  reliable numbers now come from the out-of-band mbo/hash/measurements bundles
  (the hash_benchmark binary stays for those and manual runs).
• Bazel matrix: one version per supported major (7.2.1 / 8.7.0 / 9.1.1,
  dropping the redundant 9.0.2); the 7.x/8.x rungs run on ubuntu only
  (build-system compat is platform-agnostic), macOS keeps the pinned default.
• Clang LLVM ladder: oldest + pinned-default/newest only (20.1.8, 22.1.8);
  dropped the 21.1.8 middle rung and fastbuild. asan and cpp23 run on the
  newest rung only; the oldest (20.1.8) just proves the minimum LLVM still
  builds (opt).
• asan consolidated: gcc-14 (early, in test-gcc) + clang-22 on both OSes;
  dropped the redundant clang-20 asan.
• test-gcc drops gcc-13 (still built at opt later by test-bcr's
  ubuntu+gcc rungs).
• Fixed a stale reference claiming LLVM 20.1.8 was the default pin (it is 22.1.8).

Verification

• bazel test //mbo/... (250 targets) and //mbo/hash/... (6 tests) pass.
• Bumped MODULE.bazel 0.13.1 -> 0.13.3: the generated constant rotates
  (0x9F24EE18B4458070 -> 0x79EC7046370E0C65) and all tests still pass;
  reverting to 0.13.1 restores the constant and tests pass. No committed file
  changed, so the CI failure that motivated this cannot recur.
• CHANGELOG condensed to the house style (brief, verb-first); the 0.13.0 restyle
  is presentation only - released content unchanged.