feat: one-step soothfast action with bot landing

[Verdenroz]

What changed

The root action.yml was "install the CLI". It is now the whole adopter surface: one uses: Verdenroz/soothfast@<tag> step in an existing workflow gates pull requests and lands regenerated files as soothfast-bot on the default branch. Everything it runs lives in action/*.sh, the same scripts this repo's own workflows call, so the adopter path is exercised here on every merge.

• Extended action.yml with prepare, gate, regen, bot-token, and land steps, dispatching on github.event_name and the default branch. New inputs: binary, packages (auto-detected from cargo metadata when empty), gate, changelog, spec, baseline, rustdoc-toolchain, token, bot-token, bot-slug, broker. Added branding for the Marketplace.
• Added action/prepare.sh (default-branch lookup, early exit when a run has nothing to do, package detection, unshallow, base-ref fetch, valgrind on Debian-family runners, rustdoc toolchain), action/gate.sh (gate every package, last forty lines of each in one PR comment, failed output so the triage upload happens before the step fails), action/comment.sh (creates or updates the comment found by a marker line, since github.token's author is shared with every other action), and action/regen.sh (baseline, changelog against the latest tag, spec gen, changed output).
• Minting and landing run only when regen.sh reports a change, so a no-op push never asks the broker for a token.
• Pinned the rustdoc-toolchain default to the nightly the release was tested with; the Makefile now reads that pin from action.yml so there is one place to bump.
• The adopter snippet grants contents: read, pull-requests: write, and id-token: write; nothing in the step needs contents write, the push goes through the bot token.
• Rewrote the README "In CI" section around the one-step snippet and added docs/ci.md (setup, the environment's deployment side effects and the two-job alternative, what happens on each event, why the environment, every input, action-ref versus CLI-version coupling, bring-your-own-token, self-hosted runners, the reusable gate workflow). Added ci.md to the site nav after gating.md.

Closes #158. Closes #14.

Why

Adopting soothfast should cost what codecov costs: one line in CI and one App install. Until now the bot pattern needed the App private key, which only the App owner has, so the changelog and spec flows could not leave this repo. With the broker in place, the missing piece was a single action that does the right thing on both events without a second workflow file. #14 asked for a token broker so the key never leaves one place; that is what bot/ is, so it closes here rather than as a separate service design.

How was this tested

• shellcheck 0.11.0 on every script in action/: clean.
• bash -n on every script.
• cargo metadata auto-detection checked against this workspace: it lists the seven self-bench crates.
• Not run end to end: a composite action can only be exercised from a consuming repository. First real run is pointing finance-query at this commit; the pull-request path posts a gate comment, the push path lands bot/soothfast-update authored by soothfast-bot.
• make check and make gate were not run for this layer. It changes no Rust.

Checklist

• make check passes (fmt, clippy -D warnings, cargo test --workspace)
• make gate BASE=master passes, or any intentional cost change is explained above
• Tests added/updated for new behavior (not required for docs/CI-only changes)
• Public API items have /// doc comments
• No new dependency, or its justification is included above (see Dependency Policy)
• Docs (README.md, docs/, soothfast:bind/soothfast:claim markers) updated if behavior changed

[github-actions]

soothfast gate

gate: measuring merge-base of origin/feat/soothfast-bot-workflows in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.26% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_spec::bench_openapi_diff walltime_median_ns 4877632.0 -> 4877632.0 (+0.0%)
ok    soothfast_spec::bench_openapi_diff allocs 77722 -> 77722 (allowed <= 81608)
ok    soothfast_spec::bench_openapi_diff alloc_bytes 10815487 -> 10815487 (allowed <= 11356261)
ok    soothfast_spec::bench_openapi_document walltime_median_ns 1741109.0 -> 1741109.0 (+0.0%)
ok    soothfast_spec::bench_openapi_document allocs 30152 -> 30152 (allowed <= 31659)
ok    soothfast_spec::bench_openapi_document alloc_bytes 4715065 -> 4715065 (allowed <= 4950818)
ok    soothfast_spec::bench_serialize_yaml walltime_median_ns 5770347.0 -> 5770347.0 (+0.0%)
ok    soothfast_spec::bench_serialize_yaml allocs 74277 -> 74277 (allowed <= 77990)
ok    soothfast_spec::bench_serialize_yaml alloc_bytes 8533615 -> 8533615 (allowed <= 8960295)
ok    soothfast_spec::bench_openapi_diff assert complexity: claimed O(n); growth drift x1.68 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_openapi_document assert complexity: claimed O(n); growth drift x1.55 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_serialize_yaml assert complexity: claimed O(n); growth drift x1.19 over sizes [16, 64, 256] (limit x2.5)
gate: passed (3 item(s))

[github-actions]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.24% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_sdk::bench_emit_typescript walltime_median_ns 2134783.0 -> 2134783.0 (+0.0%)
ok    soothfast_sdk::bench_emit_typescript allocs 42930 -> 42930 (allowed <= 45076)
ok    soothfast_sdk::bench_emit_typescript alloc_bytes 2938940 -> 2938940 (allowed <= 3085887)
ok    soothfast_sdk::bench_lower walltime_median_ns 1408196.0 -> 1408196.0 (+0.0%)
ok    soothfast_sdk::bench_lower allocs 23907 -> 23907 (allowed <= 25102)
ok    soothfast_sdk::bench_lower alloc_bytes 2064788 -> 2064788 (allowed <= 2168027)
ok    soothfast_sdk::bench_emit_typescript assert complexity: claimed O(n); growth drift x1.02 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_sdk::bench_lower assert complexity: claimed O(n); growth drift x1.33 over sizes [16, 64, 256] (limit x2.5)
gate: passed (2 item(s))