ci: V-model pipeline for native-ci and GitHub CI (Refs #254)

[AlexMikhalev]

Refs #254. V-model CI pipeline for native-ci (source of truth) and the GitHub mirror, kept in sync per docs/ci-gap-analysis.md.

• rust-toolchain.toml pins 1.97.1 (fixes the GitHub red since 2026-09-01: unpinned rustfmt)
• deny.toml with every advisory triaged; lockfile bumps held until #252 Phase 3; children #256 #257 #258, terraphim-ai#3374
• .config/nextest.toml ci profile (JUnit, no fail-fast, retries only for terraphim_server-backed binaries)
• check -> test -> coverage (65 from a measured 67.51 baseline) -> ub-gates (nightly Miri)
• GitHub: 3-OS matrix + informational benchmark job

Known: #264 (codex test under workspace feature unification) is a pre-existing failure and will show in the test gate.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WjGks4DGYdDw3QLgu32S96

[AlexMikhalev]

Status: the pinned toolchain fixed the rustfmt failure that has kept this workflow red since 2026-09-01, and a whitespace-only commit formats the files this lineage had committed unformatted. The check job now fails at clippy with failed to load source for dependency terraphim_service: the private Gitea registry answers "Not available" to the GitHub runner, so nothing on this mirror can resolve the 1.21.x family until #210 (crates.io publication) or the registry token is confirmed usable in pull-request runs. Leaving this draft open as the tracking PR for the mirror.

[AlexMikhalev]

The build failure is pre-existing infrastructure, not this PR

The reworked job now gets all the way to cargo clippy --workspace --all-targets -- -D warnings, which fails while fetching a private-registry dependency:

error: failed to download from https://git.terraphim.cloud/api/packages/terraphim/cargo/api/v1/crates/terraphim-markdown-parser/1.20.2/download
... got 403
body:
  Not available

Evidence this is not caused by this PR:

• Every recent ci.yml run on canonical main is failing too: 37193419403 (eaf8def), 37192699722 (e94ff47), 37149867050 (06cf71a), 36876416618 (ce700b0).
• The crate downloads HTTP 200 anonymously but returns 403 when the token is sent — so CARGO_REGISTRIES_TERRAPHIM_TOKEN is stale/invalid.

Tracked in terraphim-clients#348. Unblocking requires refreshing that secret (or removing it, since the crate is anonymously readable).

What this PR fixed to get here

• rebased onto canonical main; the single .github/workflows/ci.yml conflict resolved by merging the canonical jobs with the V-model jobs;
• restored the canonical build job name required by tests/test_release_ci_contract.py (the actionlint-provisioning contract), which had been renamed check.

The PR is mergeable and the .github/scripts forge-drift invariant still holds.