ci(format): pin cppcheck via uvx and make it blocking

[sqr00t]

Closes #27.

Completes the cpp job that #21 started. cppcheck now blocks, is version-pinned, and comes from
PyPI rather than apt — the job installs nothing from the system at all.

Why not just pin apt

You spotted the symptom today: the cppcheck install wedged for over an hour on three separate
runs (#15, #22, #16) while the identical job finished in 20–70 seconds elsewhere. Pinning the apt
version would not have helped — Ubuntu carries only whatever its archive holds for a given runner
image, so the pin would be dictated by the image rather than chosen, and the reliability problem
would remain.

2cc6320 already capped it at 5 minutes and made it non-fatal. That stopped a wedge from taking the
blocking clang-format result down with it, but it treats the symptom. This removes the cause.

What changed

Before	After
sudo apt-get update && apt-get install -y cppcheck	uvx --from cppcheck==1.5.1 cppcheck (Cppcheck 2.17.1)
Unpinned — a runner-image bump could add diagnostics	Pinned, same pattern as ruff@0.14.10 and clang-format@22.1.8
Advisory (continue-on-error)	Blocking
Default check level	--check-level=exhaustive

On --check-level=exhaustive: it is not decoration. At the default level cppcheck emits an
informational normalCheckLevelMaxBranches notice on energy_build.cpp, and --error-exitcode=1
counts that as a failure — so the job would go red on a notice rather than a defect. The options were
to suppress the notice or to actually analyse every branch. Analysing is the honest fix, and on a
1,231-line src/ it costs nothing measurable.

On scope: clang-format checks two files, cppcheck checks all of src/. That asymmetry is
deliberate and now stated in ADR 0010 — analysis reads the sources, it does not rewrite them, so
it does not threaten the byte-identity that ADR 0002 protects. The consequence is recorded too: a
genuine cppcheck finding in an upstream file cannot be fixed locally, it has to go upstream.

Verification

Run locally on this branch, all from the pinned versions CI uses:

uvx clang-format@22.1.8 --dry-run --Werror src/shim.hpp src/bindings.cpp   # clean
uvx --from cppcheck==1.5.1 cppcheck --enable=warning,portability \
  --check-level=exhaustive --suppress=missingIncludeSystem \
  --error-exitcode=1 src/                                                  # exit 0
uv run pytest -q                                                           # 30 passed

Documentation in the same PR

Unlike #21, the code and its documentation land together, so no intermediate commit describes the
wrong behaviour:

• ADR 0010 — Decision gains the cppcheck pin; two new Consequences (two more pinned versions to
  maintain; uvx/PyPI now on the critical path instead of apt); a new rejected alternative
  (pinned apt); and the "upstream files are unchecked" line corrected, since they are analysed now
• CONTRIBUTING.md — the CI table row, with the exact local reproduction command
• ONBOARDING.md — both places that called it advisory
• docs/runbooks/ci-triage.md — section 5 rewritten, plus a new "if cppcheck fails" branch
  covering the upstream-file case and the exhaustive-flag trap
• docs/ROADMAP.md — task 3.4 struck through as done; only 3.1 remains in Phase 3

Stack

Top of the chain, above #22.

main
 └── fix/gcc-cpp-compat            #10
      └── docs/adr-records         #15
           └── docs/runbooks       #16
                └── docs/roadmap-and-rust-port  #17
                     └── docs/entry-documents   #18
                          └── docs/cpp-format-policy  #22
                               └── ci/cppcheck-pinned  ← this PR