Enable public reexport QA by default

[ChrisRackauckas-Claude]

Ignore until reviewed by @ChrisRackauckas.

Summary

• change run_qa so check_reexports defaults to true
• require facade packages to list intentional public bindings in reexports_allow
• retain check_reexports = false as an explicit diagnostic escape hatch
• bump SciMLTesting from 2.4.0 to 2.5.0
• update the public documentation and integration tests for the new default

This intentionally makes the stricter QA behavior the default in a minor release. A plain
run_qa(pkg) now fails when pkg exposes an unapproved dependency binding; packages that
deliberately provide a facade API must maintain an explicit allowlist.

Verification

• Julia 1.10: Pkg.test() passed, 326/326; direct SciMLTesting 2.5.0 load passed
• Julia 1.12: Pkg.test() passed, 341/341; direct SciMLTesting 2.5.0 load passed
• Runic passed
• git diff --check passed