docs: add TESTING.md covering test tiers, Docker suites, and CI gates

[joshrotenberg]

Closes the "Add a dedicated TESTING.md covering local tiers, Docker prerequisites, ignored live tests, and CI expectations" checkbox in #628.

Why

There was no single place describing how the repository is tested. Test invocations lived in module doc comments inside the test files themselves, which meant you had to already know a suite existed to find out how to run it. Some of those comments are also stale: crates/redisctl/tests/enterprise_docker_integration_tests.rs and crates/redisctl-mcp/tests/enterprise_mcp_docker_integration_tests.rs both tell you to run docker compose up -d, but there is no compose file at the repository root. The Enterprise demo cluster is at docker/docker-compose.enterprise-demo.yml.

What TESTING.md covers

• Four test tiers with the exact command for each: unit tests, integration tests under crates/*/tests/, wiremock-backed MCP request-shape tests, and the #[ignore]d live Docker suites.
• Why the unit-test target flags differ per package, mirroring the comment in ci.yml: redisctl is bin-only so --lib errors there, redisctl-core has no bin, and --bins matters for redisctl-mcp because the safety-tier registration tests live in main.rs.
• Docker prerequisites: the correct compose path, the init container to watch for readiness, the four REDIS_ENTERPRISE_* values the suites expect, REUSE_CONTAINERS=1 for faster iteration, and why the MCP Enterprise suite needs --test-threads=1.
• Skip behavior: both Enterprise suites probe the cluster and return early with a skip message on stderr, so an --ignored run against a stopped cluster reports passes with skip messages rather than failures.
• A feature-flag gotcha: redis_tools.rs and redis_stack_tools.rs are #![cfg(feature = "database")] and enterprise_mcp_docker_integration_tests.rs is #![cfg(feature = "enterprise")], so a file whose feature is off compiles to an empty binary and silently passes. Use --all-features when you want to be sure a suite ran.
• CI expectations: a table of what each ci.yml job runs, which ones gate the aggregate CI Status check (non-Linux build failures do not), plus the docs.yml, cargo-deny.yml, and security.yml gates and which of their steps are continue-on-error.

Deliberately no test counts: those drift on every PR that adds a test.

Also changed

• CONTRIBUTING.md: links to TESTING.md from both the development-setup and testing sections, and the compose command is corrected from docker compose up -d to the real path.
• README.md: links to TESTING.md from the Contributing section.

Checks

• cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --workspace --all-features: all pass.
• markdownlint '**/*.md' --disable MD013 MD033 MD041 on the changed files: TESTING.md is clean. CONTRIBUTING.md and README.md report the same 16 pre-existing errors before and after this change, so no new ones.

Not covered

The other unchecked boxes in #628 (hosted Enterprise/Cloud test environments, credential rotation ownership, spend limits, the test-badge decision) need infrastructure and maintainer decisions rather than documentation, so they stay open.