Adapt CI diagnostics, verified publishing, and contributor rules

[helly25]

Bring the infrastructure improvements from proto #100 and xff #835–848 (excluding #841) into coderef while retaining its Rust/WASM/TypeScript tooling. CI preserves build timing diagnostics and limits cache writes to main; GitHub releases publish only after all platform assets and remote checksums are verified. Shared contributor rules and site artwork are adapted to this repository.

AG;DR

• Preserve all existing CI gates and target-specific Cargo cache keys. Cancel only superseded PR runs, record seven-day Cargo timing artifacts, and report repository cache usage on main. Release-only cache namespaces may build cold.
• Verify exactly four archives and four checksum files before creating/resuming a draft. Verify every uploaded remote digest before publication. Published releases are immutable: identical retries succeed without mutation; incomplete or changed assets fail. API failures never imply a missing release. Release candidates do not replace latest.
• Keep v-prefixed tags, version invariants, CLI conformance, and GitHub → npm → Marketplace ordering. No dependency pins, product semantics, or package versions change.
• Synchronize applicable Git/PR and shell rules, preserving DESIGN.md authority and existing Rust/TypeScript checks. Document conservative local Cargo job limits separately from test/runtime threads. Add deployment-only favicon decoration while preserving the schema endpoint and retained snapshots.
• Local development validation on this commit: all 40 Python tests passed; full pre-commit passed, including formatting, Clippy, version checks, and self doctor/check; cargo test --all-features --locked passed with CARGO_BUILD_JOBS=2. No Rust or TypeScript source changes. All current-head GitHub CI checks passed, including Rust, WASM, extension/VSIX, npm wrapper, schema, docs, release-site, and the final gate.
• Additional actionlint audit found only pre-existing shell diagnostics and the installed validator's lack of support for the existing Pages concurrency.queue field; repository pre-commit passes. Live tag publication remains an external integration, covered here by mocked orchestration tests rather than a real release.
• Independent PR; no merge ordering dependency on the other infrastructure rollout PRs. No release or deployment is requested by this PR.