ci: select verification and preserve the supported toolchains #53

Problem

Pull requests run every native platform, stress, instrumentation, proof, coverage, and packaging job even when the changed files affect none of those contracts.
The main push repeats that verification, and CodeQL repeats its scheduled scans.
Renovate #30 selects a SHA-2 dependency that requires Rust 1.85 while the project supports Rust 1.84.
It also changes a nightly installation without updating the public API tool's selector.

Expected behavior

Run a deterministic fast check on every pull request and merge group.
Select Windows behavior, API compatibility, proof layers, and packaging checks from their actual source inputs.
Require every selected job to succeed and reject missing or invalid selection data.
Keep focused local investigations available without recurring hosted campaigns.
Keep Rust 1.84 compatibility and track coupled nightly declarations together.
Present the installation and one working example in a short generated README and matching repository description.

Scope

Reconcile compatible dependency and action updates from #30, the verification workflows, tool pins, and shared Renovate configuration.
Correct the public API toolchain declaration and add a consistency check for its installations.
Generate repository metadata without changing the existing license grants, and update the verification documentation and decision record.

Validation

Run the relevant repository checks on Windows and verify the Rust 1.84 floor.
Check workflow syntax, action security, selection cases, aggregation failure controls, and Renovate extraction.
Run the source-selected Linux checks in the project's pinned environment.
Verify the README example and current-head required checks before merge.