chore(ci): externalize workflow scripts and relocate main flow doc (#722)

* feat: Add GitHub Actions workflows for security audits, CodeQL analysis, contributor updates, performance benchmarks, integration tests, fuzz testing, and reusable Rust build jobs

- Implemented `sec-audit.yml` for Rust package security audits using `rustsec/audit-check` and `cargo-deny-action`.
- Created `sec-codeql.yml` for CodeQL analysis scheduled twice daily.
- Added `sync-contributors.yml` to update the NOTICE file with new contributors automatically.
- Introduced `test-benchmarks.yml` for performance benchmarks using Criterion.
- Established `test-e2e.yml` for running integration and end-to-end tests.
- Developed `test-fuzz.yml` for fuzz testing with configurable runtime.
- Created `test-rust-build.yml` as a reusable job for executing Rust commands with customizable parameters.
- Documented main branch delivery flows in `main-branch-flow.md` for clarity on CI/CD processes.

* ci(workflows): update workflow scripts and rename for clarity; remove obsolete lint feedback script

* chore(ci): externalize workflow scripts and relocate main flow doc

.github/workflows/label-policy-sanity.yml

@@ -1,74 +0,0 @@
-name: Label Policy Sanity
-
-on:
-    pull_request:
-        paths:
-            - ".github/label-policy.json"
-            - ".github/workflows/labeler.yml"
-            - ".github/workflows/auto-response.yml"
-    push:
-        paths:
-            - ".github/label-policy.json"
-            - ".github/workflows/labeler.yml"
-            - ".github/workflows/auto-response.yml"
-
-concurrency:
-    group: label-policy-sanity-${{ github.event.pull_request.number || github.sha }}
-    cancel-in-progress: true
-
-permissions:
-    contents: read
-
-jobs:
-    contributor-tier-consistency:
-        runs-on: blacksmith-2vcpu-ubuntu-2404
-        timeout-minutes: 10
-        steps:
-            - name: Checkout
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-            - name: Verify shared label policy and workflow wiring
-              shell: bash
-              run: |
-                  set -euo pipefail
-                  python3 - <<'PY'
-                  import json
-                  import re
-                  from pathlib import Path
-
-                  policy_path = Path('.github/label-policy.json')
-                  policy = json.loads(policy_path.read_text(encoding='utf-8'))
-                  color = str(policy.get('contributor_tier_color', '')).upper()
-                  rules = policy.get('contributor_tiers', [])
-                  if not re.fullmatch(r'[0-9A-F]{6}', color):
-                    raise SystemExit('invalid contributor_tier_color in .github/label-policy.json')
-                  if not rules:
-                    raise SystemExit('contributor_tiers must not be empty in .github/label-policy.json')
-
-                  labels = set()
-                  prev_min = None
-                  for entry in rules:
-                    label = str(entry.get('label', '')).strip().lower()
-                    min_merged = int(entry.get('min_merged_prs', 0))
-                    if not label.endswith('contributor'):
-                      raise SystemExit(f'invalid contributor tier label: {label}')
-                    if label in labels:
-                      raise SystemExit(f'duplicate contributor tier label: {label}')
-                    if prev_min is not None and min_merged > prev_min:
-                      raise SystemExit('contributor_tiers must be sorted descending by min_merged_prs')
-                    labels.add(label)
-                    prev_min = min_merged
-
-                  workflow_paths = [
-                    Path('.github/workflows/labeler.yml'),
-                    Path('.github/workflows/auto-response.yml'),
-                  ]
-                  for workflow in workflow_paths:
-                    text = workflow.read_text(encoding='utf-8')
-                    if '.github/label-policy.json' not in text:
-                      raise SystemExit(f'{workflow} must load .github/label-policy.json')
-                    if re.search(r'contributorTierColor\s*=\s*"[0-9A-Fa-f]{6}"', text):
-                      raise SystemExit(f'{workflow} contains hardcoded contributorTierColor')
-
-                  print('label policy file is valid and workflow consumers are wired to shared policy')
-                  PY