feat(ci): add Miri UB verification to CI

[kalwalt]

Adds a Miri job that checks PureCV's unsafe slice reinterpretations for undefined behaviour on every push and PR, plus a plan document, a README badge, and a correction to a safety claim the code did not support.

Result: no undefined behaviour found. Both legs run clean — 0 failures, 0 unsupported operations, 0 Stacked Borrows violations. All six production unsafe blocks reachable without parallel are verified.

Leg	Result	Time
baseline (std)	299 passed, 0 failed, 9 ignored	271s
simd (std,simd)	355 passed, 0 failed, 9 ignored	229s

Why the approach differs from the issue

The plan in #81 would have verified nothing. Every production unsafe block is simd-gated, so the proposed no-features run touches none of them — the issue's "exclude pulp SIMD" and "verify all unsafe code" requirements are mutually exclusive as written. This uses two legs instead: a fast required baseline, and a std,simd leg that reaches the real unsafe.

Four other corrections are documented in .agents/MIRI_PLAN.md §7 — notably structural.rs has no unsafe block (line 278 is a comment explaining why it was avoided), and data_ptr/data_ptr_mut live in matrix.rs and contain no unsafe.

Decisions that needed measurement

• Runtime. The unfiltered suite takes 41 minutes. But 5 tests are 82% of that, and the remaining 293 finish in 139s. Nine #[cfg_attr(miri, ignore)] annotations bring it to ~4 minutes. Excluded for runtime only — none of the nine touches unsafe, and nothing in the suite proved Miri-incompatible.
• Doc-tests. Two ORB examples cost 767s while duplicating unit-test coverage, so --lib skips them. There is no tests/ directory, so --lib is the whole suite; cargo test in ci.yml still runs doc-tests.
• MIRIFLAGS. The issue proposed -Zmiri-strict-provenance, which is now Miri's default and deprecated — passing it risks hard-failing on a future nightly. What is actually needed is -Zmiri-deterministic-floats: Miri injects random error into transcendental float ops, which breaks the Box-Muller determinism test in rng.rs on a last-ULP difference. The flag keeps that test running rather than ignoring it.
• Separate workflow file. GitHub badges are per-workflow, not per-job, so the issue's "add a job to ci.yml" and "add a badge" requirements are incompatible. A separate file also keeps nightly flakiness out of the main CI badge.

Notes for review

The simd leg is continue-on-error: true. pulp turned out fully Miri-compatible, so this is stricter than necessary — but all local evidence is from x86_64-pc-windows-msvc and CI runs ubuntu-latest, where Miri's intrinsic support differs. Please flip experimental: false once it is seen green on Linux; it is a one-word diff.

Known coverage gap. The parallel + simd chunked from_raw_parts_mut in arithm.rs stays unverified — neither leg enables parallel. The sequential equivalents share the same reinterpretation logic and are covered. Tracked in #94.

.gitignore change. .agents/* is ignored, so the plan document is un-ignored by exception, matching the existing pattern for instructions.md and workflows/.

The badge will 404 until this merges and the workflow runs on dev.

Fixes #81