docs(contributing): document the ci tiers, the rig, and suite invariants

[BSpendlove]

Problem

The contributor docs describe a CI model the project no longer runs. Both please_read_first.md and guidelines.md state that build and unit tests are the only gate a PR clears, and that integration tests run only after a merge to main, so they never run against a PR. Every PR now also clears a core set of integration suites on the self-hosted rig, with the full matrix nightly and again before a release. Nothing documents the rig, the tiers, or the invariants a new containerlab suite has to carry, so a contributor adding a suite has to rediscover them by failing.

Change

A new page, CI and Review, covering what runs on a PR and where, the three tiers and why the per-PR set is deliberately a subset, how the rig allocates CPU slots and stores evidence, how to run suites locally against the same dataplane CI uses, the invariants a new suite must carry and the failure each one prevents, what a reviewer checks, and the osvbng-vpp and pin-bump flow. The two stale paragraphs are corrected to point at it, and it joins the nav.

The suite invariants are the section worth reviewing closest: the IPv4-only management network, the :=auto CPU slot templating, per-suite bridge and veth names, OSVBNG_RESPAWN, gating restart checks on the state file rather than the log line, and the twelve minute budget. Each is written with the failure it prevents, because each was learned from one.

Verification

mkdocs.yml parses and the new page is in the nav. Prose only, no code or workflow changes. Every claim about CI behaviour is drawn from runs on this repository over the last day, including the timeout-reads-as-cancelled note and the fork-PR approval state.

Not merged deliberately

Left open for maintainer review rather than self-merged.