chore: add full-treatment quality gates

Mirrors the ucobs convention:
- justfile aggregates test-{unit,clippy,fmt,doc,deny,fuzz,miri,mutants}
  behind a single 'just test' target.
- mise.toml pins rust + cargo-{deny,fuzz,mutants,nextest}.
- deny.toml enforces permissive licenses only and bans wildcard /
  unknown-source deps.
- CLAUDE.md captures identity and first principles.
- Cargo.toml adds unsafe_code = forbid and docs.rs all-features metadata.

cargo check (all feature permutations), nextest, clippy with warnings
as errors, fmt check, doc, and deny all pass. fuzz/miri/mutants land
in follow-up commits.

Cargo.toml

@@ -29,6 +29,12 @@ std = []
 [dev-dependencies]
 proptest = "1"
 
+[package.metadata.docs.rs]
+all-features = true
+
+[lints.rust]
+unsafe_code = "forbid"
+
 [lints.clippy]
 unwrap_used = "deny"
 expect_used = "deny"