[G2] Embedder guide, example consumer crate, and a CI job that builds an out-of-tree Rust consumer against the published crates #182

Part of #160 (group 2 — depends on #162 single crate published and #178 facade; parallel with #179/#180/#181).

Problem

Nothing today proves that a crate outside this workspace can consume relayhistory. docs/native-sdk-migration.md says "Rust embedders must also update and recompile" but there is no embedder documentation, no example, and CI only builds the workspace. burn will be the first embedder and must not be the integration test.

Scope

1. docs/sourcing-sdk.md: what SessionStore is for; StoreOptions (AI_HIST_DB, XDG path, explicit path, provider roots override, read_only); the sync / hydrate / watch lifecycle and locking rules (what happens when ai-hist sync runs concurrently; Error::SyncLocked); the evidence model (one section per struct in [G2] SessionStore facade: the single public entry point (seven methods, typed evidence, no raw connections, no contract constant) #178 with a per-source population table generated from the capability matrix); accounting semantics (link docs/usage-accounting.md from [G1] Usage normalization in core: per-request usage records, session summary, and moving attribute_session_usage out of the cloud plugin (supersedes #99 scope) #172); the change-feed contract ([G2] Change feed: revision-stamped SessionStore::changes_since() with named consumer cursors, for incremental downstream ingest #179): watermark, named consumer cursors and commit, tombstones, re-hydration replaces, WatermarkAheadOfStore → full resync; versioning: Cargo semver is the contract — what a minor bump may change pre-1.0, how the cargo public-api snapshot is updated; feature flags (delivery, opencode-backup, git-hooks, unstable-internal); a "what relayhistory will never do" list (no cost, no pricing, no token estimation, no similarity-based linking); an appendix listing exactly which CLI/napi/plugin call sites still need unstable-internal and why.
2. examples/rust-consumer/: a standalone Cargo project (its own Cargo.lock, not a workspace member) that depends on ai-hist = "<version>" (crates.io, default features) and, against a tempdir HOME populated from the fixture corpus: opens the store, syncs, iterates sessions(), prints per-session normalized usage totals by model from session(), drains changes_since once with a named consumer and commits, and exits. It doubles as the smoke test for [G1] Merge ai-hist-core and ai-hist-engine into one published ai-hist crate with feature gates, a release pipeline and a semver policy #162's published artefact.
3. CI: a job in ci.yml that builds examples/rust-consumer with [patch.crates-io] pointing at the workspace (so PRs are checked before publish) and a nightly/workflow_dispatch variant that builds it against the published crate (catches a broken publish).
4. API stability check: cargo public-api -p ai-hist snapshot checked in as crates/ai-hist/public-api.txt; CI diffs it; a change requires updating the file in the same PR and a ### Rust API changelog entry ([G1] Merge ai-hist-core and ai-hist-engine into one published ai-hist crate with feature gates, a release pipeline and a semver policy #162 policy). The check also asserts the snapshot contains no rusqlite type.
5. README.md "Embedding from Rust" points at the guide and example.

Acceptance

• cd examples/rust-consumer && cargo run prints usage totals for the corpus sessions and a committed watermark.
• CI job green; the published-crate variant passes on the first release after [G1] Merge ai-hist-core and ai-hist-engine into one published ai-hist crate with feature gates, a release pipeline and a semver policy #162 + [G2] SessionStore facade: the single public entry point (seven methods, typed evidence, no raw connections, no contract constant) #178.
• docs/sourcing-sdk.md reviewed by whoever picks up burn #557 — their questions become doc fixes before that issue starts.

Out of scope

TS docs (#181).