Establish G0-G4 verification architecture

[terrizoaguimor]

Summary

• establishes the shared pure Rust compilation engine and Benchmark Authority v2
• adds release, documentation, benchmark, editor/LSP/CLI, site, and fail-closed publication contracts
• certifies browser output on Windows, Linux, and macOS across Chromium, Firefox, and WebKit
• models the G0-G4 path toward PliegoCSS 1.0 LTS with explicit Tailwind CSS comparison boundaries

Exact-source evidence

Source commit: 2c8e8a8b19a3cc9be98251a27f0c47b123503879
Git tree: df3cc0d1f4edc312f11b1e9bcd036777e73e4b3c

• CI: https://github.com/celiumsai/pliegocss/actions/runs/29958841989 — 12/12 jobs passed, including Rust 1.85.0 and 1.96.0 on Ubuntu, Windows, and macOS
• Browser output: https://github.com/celiumsai/pliegocss/actions/runs/29958842026 — 9/9 hosts plus aggregator passed
• CodeQL: https://github.com/celiumsai/pliegocss/actions/runs/29958844545 — Rust, JavaScript/TypeScript, and Actions passed
• Aggregated artifact: browser-output-matrix-2c8e8a8b19a3cc9be98251a27f0c47b123503879

The browser matrix covers 90 scenarios across computed style, layout geometry, responsive behavior, interactive state, reset/no-reset, bounded screenshots, and the pinned tailwind-latest lane. Maximum observed geometry delta was 0.09375 CSS px; maximum screenshot mismatch ratio was 0.000891156.

Golden refresh review

StyleId format 2 and the shared engine intentionally changed derived output identities. Reachability pruning, media-query merging, and portability goldens were refreshed only after:

• exact reproduction on Rust 1.85/1.96 and Node 22.13/24.16 where applicable
• byte-for-byte comparison against detached tag v0.1.0-rc.2 at 064dcbce96a3a5cc97a940d07566c008bb5e2d3e
• preservation of input hashes, graph cardinalities, rule order, semantic assertions, read-only checks, and fail-closed rejection cases

The temporary RC.2 audit worktree and Docker volume were removed after verification.

Release boundary

This PR closes the G4 implementation and exact-source evidence gate. It does not retroactively promote 0.1.0-rc.2 and does not publish 1.0 LTS. Release authority remains blocked until a newly named/tagged candidate binds this architecture to registry replay, production edge replay, signed binary/npm distribution, SBOM/attestations, external adoption evidence, and final promotion authorization.

The local Windows agent integration executable remains restricted by Windows Application Control; hosted CI is the cross-host authority.