Split baseline CI and release verification

[DonPrus]

Summary

• make PR/main CI a required baseline matrix across Linux, macOS, and Windows
• move full import checks and external runtime contracts into the Release workflow before artifact publication
• fix Linux owner-check compilation by using statx for runtime home trust validation
• document the GitHub baseline and release gates

Local verification

• zig build test --summary all
• zig build --summary all
• zig build test-server -Dtest-filter='runtime home' --summary all
• zig build -Dtarget=x86_64-linux-musl -Doptimize=ReleaseSmall --summary all
• zig build -Dtarget=aarch64-linux-musl -Doptimize=ReleaseSmall --summary all
• zig build check-full-import -Dengine-profile=full --summary all
• zig build test-profile -Dengine-profile=full --summary all