release: CI workflows, README badges, CHANGELOG and semver policy

[pierrick-fonquerne]

Set up the automated quality gates and the release pipeline so every PR is verified and every version tag triggers a publish.

Scope

• .github/workflows/ci.yml: parallel jobs for fmt, clippy, test, audit (cargo-deny) and doc on Linux.
• .github/workflows/publish.yml: triggered on v*.*.* tags, cross-platform matrix test then sequential cargo publish for the four crates.
• Coverage job: cargo-llvm-cov uploading to Codecov.
• CHANGELOG.md generated by cog changelog from Conventional Commits history.
• README badges: crates.io version, docs.rs, CI status, license, MSRV, coverage.
• docs/semver-policy.md: 0.x breaking change rules documented.

Acceptance criteria

• A PR with a failing clippy lint blocks the CI workflow.
• A PR with a failing test blocks the CI workflow.
• Pushing a tag v0.0.2 triggers publish.yml and publishes all four crates in dependency order.
• README displays all badges correctly on crates.io.
• cog changelog generates a populated CHANGELOG.md from the commit history.