reorg: public plumbing for the in-repo Rust workspace and the two-release flow

The engine binaries move from the impeccable-dist channel to this repo's own
GitHub Releases (tag engine-v<ENGINE_VERSION>), and the closed detector the
engine links arrives as detector-v<DETECTOR_VERSION> releases on the same
repo. This commit wires the public side for that; the crates themselves land
in the next commit.

- Launcher (sh + cmd), npm shim, fetch-engine and check-engine-release now
  download from github.com/pbakaus/impeccable/releases/download/engine-v<X>/.
- release.mjs gains `engine`: verifies ENGINE_VERSION against the platform
  package pins and the detector release, tags, pushes; release-engine.yml
  builds the five targets and publishes. check-detector-release.mjs is the
  matching release-order guard (with tests).
- Root Cargo.toml (workspace, lto = false with the reason), rust-toolchain.toml
  (exact pin), DETECTOR_VERSION, /target ignored.
- CI: rust + rust-windows jobs and an oracle job that replays the goldens
  against a source build, warn-only until the first detector release exists;
  ci-test-plan exposes a `rust` output.
- docs/ENGINE.md (the crate map and the closed-detector mechanism) and the
  CLAUDE.md engine, release-order and rules sections.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY

scripts/ci-test-plan.mjs

@@ -14,11 +14,24 @@ const isSchedule = eventName === 'schedule';
 const changedFiles = localNoChanges || isSchedule ? [] : getChangedFiles();
 const forceDeterministic = localNoChanges || isSchedule || eventName === 'push' || eventName === 'workflow_dispatch';
 const forceOptIn = eventName === 'workflow_dispatch';
+// The Rust workspace (the engine) builds and tests when its own inputs move.
+// tests/oracle is included: the goldens are the engine's behavior gate and
+// the oracle job replays them against a source build.
+const RUST_PATTERNS = [
+  /^crates\//,
+  /^Cargo\.(toml|lock)$/,
+  /^rust-toolchain\.toml$/,
+  /^DETECTOR_VERSION$/,
+  /^tests\/oracle\//,
+  /^\.github\/workflows\/ci\.yml$/,
+];
+const rustChanged = changedFiles.some((file) => RUST_PATTERNS.some((re) => re.test(file)));
 
 const plan = isSchedule
   ? {
     core: true,
     oracle: true,
+    rust: true,
     detector: true,
     live: true,
     framework: true,
@@ -31,6 +44,7 @@ const plan = isSchedule
   : {
     core: true,
     oracle: forceDeterministic || matchesSuiteTriggers('oracle', changedFiles),
+    rust: forceDeterministic || rustChanged,
     detector: forceDeterministic || matchesSuiteTriggers('detector', changedFiles),
     live: forceDeterministic || matchesSuiteTriggers('live', changedFiles),
     framework: forceDeterministic || matchesSuiteTriggers('framework', changedFiles),
@@ -98,7 +112,7 @@ function printSummary(outputs, files) {
   const deterministic = DEFAULT_SUITES.map((name) => `${name}=${outputs[name]}`).join(' ');
   console.log(`Event: ${eventName || 'local'}`);
   console.log(`Changed files: ${files.length}`);
-  console.log(`Deterministic suites: ${deterministic}`);
+  console.log(`Deterministic suites: ${deterministic} rust=${outputs.rust}`);
   console.log(
     [
       `cli_remote_e2e=${outputs.cli_remote_e2e}`,