Stage 6: automate CI and release gates

[aryamantodkar]

Summary

Turn the existing release contract into automated GitHub gates.

• Add normal PR and main CI for Python quality, Rust quality, and release packaging.
• Inspect both the wheel and source distribution for runtime metadata and forbidden model, data, benchmark, and evaluation assets.
• Install the built wheel in a fresh environment outside the checkout.
• Verify the installed Rust extension is an optimized release build.
• Check local Markdown links and frozen v0.1.0 dataset, model, benchmark, and Hub identities.
• Add a manual model-backed release smoke workflow with a fresh Hub cache, live tag-to-commit verification, and offline cached restart.
• Keep full model download and inference out of normal PR CI.

Protected invariant

A PR must not merge when source tests pass but the release artifacts, native build profile, CLI entry point, packaged contents, frozen release identities, or source distribution boundary are wrong.

Validation

• uv run ruff format --check .
• uv run ruff check .
• uv run pytest — 144 passed
• cargo fmt --manifest-path rust/Cargo.toml -- --check
• cargo test --manifest-path rust/Cargo.toml — 60 passed
• uv build
• Wheel and sdist inspection passed.
• Fresh wheel installation passed outside the checkout.
• Release Rust metadata and CLI smoke checks passed.
• Local link and frozen-boundary checks passed.

Clippy is not enabled because the current Rust code has existing unrelated warnings; the Stage 6 workflow keeps the required formatting and test gates.