ci: add flaky-test management (#489) - #2

Summary

• Stack detected: Rust crate (cargo, no package.json) — ci.yml (PR gate) + publish.yml (tag-driven crates.io release).
• ci.yml test job switched to cargo-nextest with .config/nextest.toml (retries = 2) so a flaky test is retried instead of red-flagging the PR; doctests kept on plain cargo test --doc (nextest doesn't run them).
• ci.yml coverage job switched to the combined cargo llvm-cov nextest --fail-under-lines 80 form so coverage instrumentation is still collected under nextest and the >=80% line gate still runs (the split nextest run + separate llvm-cov form collects zero coverage and fails the gate — the bug in the first-pass PRs, per #489).
• publish.yml (tag-triggered deploy) no longer re-runs the full test job before publish — removed job + its needs: test. The PR gates in ci.yml already tested this exact tree (branch protection requires up-to-date-with-main), so a redundant/flaky re-run on the release path could block a release for code already proven green (#488 release-blocker). Publish now = build + package + publish only.

Test plan

• CI green on this PR (fmt/clippy/nextest/doctests/docs + coverage gate) — GitHub Actions validates.
• Not merged per task instructions; no heavy local build run.

Refs #489, #488

Co-Authored-By: Claude noreply@anthropic.com