[P4suta]

Summary

Run Linux quality checks and a Windows x64 compile and spawn smoke on every pull request and merge group.
Move the native suites, compatibility checks, instrumentation, API snapshot, package checks, and all seven proof layers into qualification of the signed release commit.
Require complete qualification before creating the release candidate.

Remove the separate package job and duplicate doctest invocation while preserving their coverage.
Add just check for ordinary local verification and test the production YAML, jq contracts, and release-source bindings.
Include the private tooling crate in dependency checks and accept its exact foldhash 0.2.0 Zlib dependency.
Keep parser updates compatible with Rust 1.84 and protect the MSRV declaration in the moved native matrix.

Closes #64.

Validation

mise x -- uv run --no-project --with 'reuse[charset-normalizer]==6.2.0' just check passed on Windows 11 Pro build 10.0.26300 with Rust 1.99.1.
The gate passed formatting, strict workspace Clippy, repository laws, 39 task tests, 13 workflow tests, one native smoke test, workspace dependency checks, license metadata checks, Typos, and Actionlint.
The workflow tests execute the production jq contracts over all 16,400 admitted terminal-result combinations and reject malformed results, broken source bindings, and incomplete proof inventories.
The 13 workflow tests also passed with Rust 1.84.1.
The four changed documents passed the basic and expository prose checks.
Strict Renovate 44.181.9 configuration validation and local dependency extraction passed.
The extraction found 106 dependencies in 13 files and warned that GitHub-backed lookups require a token.

Mise reports that Python 3.15.1 isn't installed locally.
The pinned Python package ran through the uv environment.
The full platform and proof inventory and the signed-tag publication path remain unrun.

Checklist

• Relevant local checks passed.
• Deterministic tests cover the behavior changes.
• Documentation describes qualification, source binding, and command changes.
• The library and API snapshot have no source changes.
• Secret scans found no credentials.
• The changes stay within the issue and include relevant documentation.

@coderabbitai ignore