ci: cover fmt, clippy, tests, doc, advisories, and MSRV

[ndreno]

Summary

• Replaces the original two-job workflow (fmt + build/test) with six parallel jobs sharing a Swatinem cargo cache, so the fork can stand on its own without leaning on upstream CI.
• Jobs: `fmt`, `clippy -D warnings` (excludes `typify-test`), `test` on Linux/Windows/macOS, `doc -D warnings`, `cargo deny check advisories`, and an MSRV build pinned to Rust 1.82.
• Adds `deny.toml` ignoring four pre-existing unmaintained-crate advisories with notes explaining the chain and cleanup path. The `tempdir` ignore pair (RUSTSEC-2018-0017 + RUSTSEC-2023-0018) clears automatically once `cargo-typify` migrates to `tempfile` — left as a follow-up.
• Adds `#[allow(dead_code)]` to two `#[cfg(test)]` helpers in `util.rs` (`all_mutually_exclusive`, `resolve`) that are intentionally retained for a TODO referenced in the surrounding comment.

Decisions worth flagging

• `typify-test` is excluded from strict clippy because the crate exists only to compile typify's generated output; its lints (`clippy::derivable_impls`, `redundant_closure`) belong to the codegen, not the source tree. Reviewable as a separate codegen-quality effort.
• MSRV pinned at 1.82 without a corresponding `rust-version` field in `Cargo.toml`. If you want stronger enforcement, we can add `rust-version = "1.82"` to each crate later.
• Publish strategy is git dependency only — no `cargo publish` workflow. Consumers depend via `git = "..."` + tag.

Follow-ups

• Swap `tempdir` for `tempfile` in `cargo-typify` dev-deps and drop the two related advisory ignores.
• Optional: tag-triggered GitHub Release workflow that just creates a release note from the changelog.

Test plan

• `cargo fmt --all -- --check`
• `cargo clippy --workspace --all-targets --locked --exclude typify-test -- -D warnings`
• `cargo test --workspace --locked`
• `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --locked`
• `cargo deny check advisories` (with new `deny.toml`)
• MSRV (1.82) — verified by CI on push