chore: workspace skeleton and dev environment (#2)

[q-soriarty]

Summary

Adds the Cargo workspace with the four empty-but-compiling crates and the two-layer development environment from ADR-0002: everything builds, tests and lints inside the devcontainer, the host only runs the container-built binary. Plan: docs/plans/2026-09-09-workspace-skeleton.md.

Closes #2

Changes

• Cargo workspace (resolver = "3", edition 2024, rust-toolchain.toml pinned to 1.98.0) with keyvo-hid, keyvo-core, keyvo-daemon, keyvo-cli; clippy all + pedantic as workspace lints, unwrap_used/expect_used denied in the lib crates
• keyvo --version via clap derive, driven by a black-box assert_cmd test (red first, then green); keyvo_core::VERSION unit test; compiles placeholders in keyvo-hid and keyvo-daemon
• Dockerfile (rust:1.98.0-slim-trixie, Node 24.21.0, just, cargo-deny, cargo-llvm-cov, cargo-nextest, cargo-insta via pinned cargo-binstall), non-root dev user with the host UID/GID
• docker-compose.yml (service rust, bind-mounted workspace, named cargo registry and git volumes), .devcontainer/devcontainer.json
• justfile: setup dev down clean rebuild shell build test lint fmt fmt-check deny cov ci in the container; run and test-hw on the host; diagrams/docs placeholders for docs: architecture diagrams with archify #4/ci: build, test, lint, coverage, CodeQL #3; COMPOSE_CMD override for podman
• deny.toml, .editorconfig, .gitattributes, .github/dependabot.yml (cargo, github-actions, docker; weekly; target develop)
• CONTRIBUTING.md and CLAUDE.md describe the real dev environment instead of the "lands with Issue chore: workspace skeleton and dev environment #2" placeholder

Automated checks

• just fmt produces no diff
• just lint (clippy, -D warnings) is clean
• just test passes (4 tests across 4 crates, cargo-nextest)
• just deny passes
• Coverage is not lowered (no baseline yet; just cov lands in CI with ci: build, test, lint, coverage, CodeQL #3)
• Documentation updated in this PR (CONTRIBUTING.md, CLAUDE.md)

User test

Host only, no Rust installed. Steps from the plan §6:

• git clone into a scratch directory, just setup: the image builds and the container starts; no cargo or rustc is used on the host
• just test: nextest lists all four crates and 4 tests pass
• just build && just run -- --version prints keyvo 0.0.0
• ls -l target bin (or stat -c '%U:%G' target bin/keyvo): owned by your user, not root
• just clean && just setup && just test: idempotent, tests pass again
• just test-hw: lists the hidraw nodes and /dev/uinput, shows input in your groups
• Optional: VS Code "Reopen in Container" attaches to the same rust service

Notes for reviewer

• cargo tree shows only clap (4.6.6) and its transitive dependencies plus assert_cmd as a dev-dependency.
• just run --version and just run -- --version both work; the recipe strips a leading --.
• missing_docs is a workspace lint at warn; with -D warnings in just lint it is effectively enforced, hence the crate-level doc comments.
• deny.toml allows wildcard path dependencies inside the workspace (allow-wildcard-paths), otherwise keyvo-core.workspace = true is flagged.
• Cold image build took about 2 minutes here; cargo tools come as prebuilt binaries.
• Issue templates still render only from main; unchanged from PR docs: project foundation (#1) #5.