ci: record Cargo-Rail planning evidence

[hadronzoo]

Cargo-Rail decides which CI jobs a change needs. Without planning evidence, it cannot prove that a file is outside the Rust build, so it runs the Rust jobs for almost every change. This PR records that evidence on main and gives it to the planner. A change that no compiler reads, such as a Markdown edit, then skips the Rust jobs.

A new "Planning evidence" job in the Check workflow records which workspace files the cargo.build work item reads. It runs on every push to main and never on pull requests, so it is never a required check. It uses rust-cache, because recording works on a warm target directory. It saves the record in the Actions cache under the commit that it describes. CI cost: this job compiles the extension once on every push to main.

Both plan jobs now install the stable toolchain, restore the evidence of the base commit on push and pull requests, and pass it to the planner. A cache miss is normal and only widens the plan to the current behavior. Each plan job creates the evidence directory first, because the planner rejects a missing directory but accepts an empty one. The Quality planner plans every work item on its nightly schedule and on manual dispatch, so the Clippy condition reads only the required work.

Cargo-Rail 0.30.1 has no complete evidence for Clippy or rustdoc. It marks Clippy evidence incomplete when the clippy::cargo lints run cargo metadata, and it never records rustdoc. The Clippy and Documentation jobs therefore route on cargo.build. The build evidence covers the same compiler inputs, because the extension has no cfg(doc) or cfg(test) code.

The evidence binds the Cargo environment, including RUSTFLAGS. The Check workflow set RUSTFLAGS for every job, and the Quality workflow did not. This PR removes that RUSTFLAGS and makes mold the default linker in the jobs that install it. .cargo/config.toml already sets target-cpu=x86-64-v3. The evidence job and both plan jobs then see the same Cargo environment.

The plan jobs drop the since inputs and the full-history fetch. The v10 Action selects the same comparison by default and fetches the history that it needs. The plan and evidence jobs have read-only permissions, and their checkouts do not keep credentials.

The ci work item now holds only the workflows and the Cargo-Rail policy. A new taplo work item routes .taplo.toml to the Format job only. No CI job reads the Makefile, so a Makefile change routes no work.

The extension has no Rust tests, so jobs route on cargo.build in place of cargo.test. The extension is a cdylib, which cannot run doctests, and a comment in its manifest now says so. This PR also deletes three Rust doc examples in the extension, because they only restated the prose above them.