feat(zig): pin zig 0.15.2 via mise and wire taskfile + CI job

[pythoninthegrass]

Summary

• Pin zig 0.15.2 in .tool-versions, resolved via mise which zig --tool zig@<pinned> since PATH may hold an IDE-bundled zig or a mise default for a different version
• Add taskfiles/zig.yml (format, lint, test, build, cross-compile, clean), each gated by an internal _check-zig-version task that fails with an actionable expected/found/fix message
• Wire zig:lint/zig:format/zig:test into the root lint/format/test tasks
• Add a standalone zig CI job on a Blacksmith Linux runner (.github/workflows/test.yml), cached on zig-core/.zig-cache/zig-out, and deliberately absent from every other job's needs: so it cannot extend the critical path
• Add a minimal placeholder zig-core/ (executable + one test) — no SQLite/HTTP logic; that's TASK-355.2

Notes

• AC#6 (cold vs warm cache timing) needs two real runs of the zig job on GitHub Actions and can't be measured from a worktree — left unchecked on TASK-355.1 with instructions to record it after this merges.
• This repo previously had a full Zig FFI integration (removed in fb22c40 after SIGBUS crashes under concurrent tokio execution) — an unrelated architecture (static-lib FFI vs. this HTTP-sidecar POC), but worth knowing about for TASK-355.2+.

Test plan

• task zig:format / zig:lint / zig:test / zig:build all pass locally against the placeholder zig-core/
• task zig:cross-compile fails with an actionable message when TARGET is unset, succeeds for aarch64-macos/x86_64-macos/x86_64-linux/x86_64-windows
• AC#3 exercised for all three failure modes (zig missing, version mismatch, mise missing)
• actionlint .github/workflows/test.yml clean
• Cold/warm cache timing for the new zig CI job (AC#6) — to be recorded after this merges