ci: adopt the fleet reusable workflow

[h4x0r]

ci: adopt the fleet reusable workflow

Replaces the hand-maintained ci.yml with a call to
SecurityRonin/fleet-ci@619094a

What the old file enforced (read from origin/main, not the TSV):
fmt; clippy --all-targets twice (default features and --no-default-features);
cargo test twice, same two feature sets, ubuntu only; cargo-deny; MSRV 1.85
running cargo test; a 100%-line coverage gate; a second, independent
100%-e2e gate over the integration suite; a fuzz build check; gitleaks; a soft
cargo-geiger; cargo-vet.

Inputs, each carrying an existing decision across:

os-matrix: false the old test job ran on ubuntu-latest only
msrv-check: test the old MSRV job ran the suite at 1.85, not just a build
deny-config-repo: "" keep the repo's own deny.toml; the shared fleet config
is LOOSER (multiple-versions "warn" vs "deny", and 21
RUSTSEC ignores vs none)
deny-args: --all-features
cargo-deny-action defaults its arguments input to
--all-features, so the old job checked the full-feature
graph

all-features and coverage-scope stay at their defaults. This is a
one-package workspace whose only feature is alloc, and alloc is in
default, so --workspace --all-features compiles and measures exactly the
lines the old bare cargo llvm-cov did.

Carried across as jobs, because no input can express them:

• no-default-features: the lean no_std leg of the old clippy and test jobs.
  The shared workflow builds one feature set, so that leg lives here.
• coverage-e2e: the old coverage job's second gate — the integration suite
  (--test roundtrip --test errors) must ALONE reach 100%. Copied verbatim;
  only the job scaffolding is new, and it is the same scaffolding the old
  coverage job used.
• geiger: soft, unchanged.

Relaxation, stated rather than hidden: the fleet strict gate additionally
exempts delimiter-only lines and annotated // cov:unreachable lines, which the
old hand-rolled gate did not — it failed on any zero-hit record at all. The
repo is at 100% today with no markers at all, so both gates are green; the new
one is marginally more permissive at the margin.

Added by adoption, with no old equivalent (verified green on this branch):

• path-deps: no path dependency may escape the repository
• docs: cargo doc --no-deps --workspace --all-features with
  RUSTDOCFLAGS=-D warnings (ran it on this branch: exit 0)
• fmt is now cargo fmt --all --check, clippy now --workspace
• gitleaks runs both git and dir mode with the repo's .gitleaks.toml
• cargo-vet now runs cargo fetch --locked; the old bare cargo fetch
  re-resolved Cargo.lock in the runner, so vet --locked validated a lock CI
  had just generated for itself

main has no branch protection, so no required-check name changes with this.