ci: define public release truth checks

[tcballard]

What changed

Add surfacecheck.toml as the explicit post-release truth contract for AsDecided Core.

It ties the Cargo workspace version to the repository changelog and install instructions, the public homepage and release record, canonical documentation, sitemap, llms.txt, GitHub About metadata, and the latest GitHub release. The v0.29 federation and export-contract documentation are required public surfaces.

Dependency

Requires tcballard/SurfaceCheck#2, which adds Cargo workspace version support, templated surface URLs, and native certificate roots. Keep this PR draft until that dependency is available at a pinned ref or release.

Current v0.29 audit

Against Core bb4b785 and manifest version 0.29.0:

• repository-local release facts: pass
• staged v0.29 website: 31 passed, 0 failed
• live website and GitHub: 24 passed, 14 failed

The 11 live-site failures are expected before the staged v0.29 site is published. GitHub contributes three remaining failures: latest release is still v0.28.0, the homepage still points to https://docs.asdecided.com/core/, and the description still uses the older requirements-as-code wording. The contract intentionally does not accept those stale values.

Verification

• SurfaceCheck upstream format, clippy, test, and release build gates pass
• site production build and 16/16 rendered-surface tests pass
• site lint reports 0 errors (11 pre-existing <img> warnings)
• no tag, release, package, image, registry entry, or site deployment was created