Enforce deterministic review rules in CI

[Wei Wu (wuw92)]

• Does this PR have a descriptive title that could go in our release notes? Yes.
• Does this PR add any new dependencies? No.
• Does this PR modify any existing APIs? No.
• Is the change to the API backwards compatible? N/A; no API changes.
• Should this result in any changes to our documentation, either updating existing docs or adding new ones? Yes; stale and invalid rustdoc links are corrected.

Reference Issues/PRs

Addresses #1318 (comment).

What does this implement/fix? Briefly explain your changes.

Move deterministic review feedback into blocking CI so code review can focus on semantic correctness.

1. Changed-file policy: Add one tested checker for newly added source headers, binary fixture placement and Git LFS attributes, and new too_many_arguments or single_match suppressions. The checks are extension-aware, exclude generated and test-input files, compare against the merge base, and preserve existing suppressions across file renames.
2. Documentation correctness: Extend the existing strict rustdoc job to private items and repair the baseline links, ambiguous references, and malformed markup it exposes. The job continues to use rustdoc::all, so broken intra-doc links remain merge-blocking without broad allowances.
3. Test hygiene: Check the worktree after both workspace test jobs and fail on modified tracked files or non-ignored outputs. Normal ignored build artifacts remain excluded. Extend Git LFS attributes to binary fixtures under crate-local test_data directories.

The checker tests exercise passing and failing repositories, including shebang/header handling, generated inputs, nested fixtures, missing LFS attributes, structural Clippy allows, renames, and worktree pollution.

Any other comments?

This intentionally limits enforcement to baseline-clean, cross-platform rules. Narrowing conversions, direct panic APIs, duplicate dependency versions, example execution coverage, and broader Miri gating need separate baseline cleanup or a validated allowlist before they can become low-noise merge gates.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.53%. Comparing base (1632651) to head (2edfe79).

Additional details and impacted files

@@ Coverage Diff @@## main #1370 +/- ##
==========================================
+ Coverage 91.55% 92.53% +0.98% 
==========================================
Files 521 521 Lines 100302 100302 ==========================================
+ Hits 91827 92810 +983 + Misses 8475 7492 -983 

Flag	Coverage Δ
miri	92.53% <ø> (+0.98%)	⬆️
unittests	92.49% <ø> (+1.26%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
diskann-benchmark-core/src/search/ids.rs	97.98% <ø> (ø)
...iskann-benchmark-runner/src/internal/regression.rs	98.11% <ø> (ø)
diskann-bftree/src/vectors.rs	89.58% <ø> (ø)
...kann-disk/src/search/provider/disk_sector_graph.rs	97.34% <ø> (ø)
...kann-disk/src/utils/instrumentation/timer/linux.rs	86.66% <ø> (ø)
...lter/src/encoded_attribute_provider/ast_id_expr.rs	93.78% <ø> (ø)
.../encoded_attribute_provider/ast_label_id_mapper.rs	97.41% <ø> (ø)
...odel/graph/provider/async_/inmem/full_precision.rs	81.89% <ø> (ø)
...s/src/model/graph/provider/async_/inmem/product.rs	91.07% <ø> (ø)
...ers/src/model/graph/provider/async_/postprocess.rs	100.00% <ø> (ø)
... and 15 more

... and 40 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.