build: automate releases and repository checks

[keys-i]

Supersedes #3 with byte-identical commit 3b618dd on a non-release branch. The automation head cannot match the release authorization pattern, so merging this PR cannot create a tag, GitHub Release, or PyPI publication.

What changed

• adds Release-plz semantic versioning and a serialized, recoverable release pipeline
• publishes future approved releases through PyPI Trusted Publishing and attaches the same wheels, checksums, and GitHub provenance to each GitHub Release
• adds per-tool Hyperfine benchmarks, CodeQL, dependency review, issue forms, contributor policies, and the pull request template
• moves benchmark material to benches/, human documentation to docs/, and substantial release logic to scripts/
• keeps all requested third-party research clones local and ignored; only pinned research evidence is documented

Closes #2.

Verification

• cargo test --locked
• cargo fmt --all --check
• cargo clippy --all-targets --locked -- -D warnings
• cargo build --release --locked
• native wheel installation and CLI smoke
• Actionlint, ShellCheck, Bash syntax/self-test, and Zizmor pedantic
• mandatory fallback gate: VERDICT: PASS (fixed gatekeeper alias unavailable)

Release gate and rollback

This infrastructure PR does not authorize a release. A future release PR must use the documented release branch, pass the semantic gate, and satisfy the protected pypi environment before publication. GitHub distribution uses Release assets rather than GitHub Packages because this project ships Python wheels.

Rollback is a revert of commits 18b1b52 and 3b618dd; no UI evidence applies.