fix(content_id): validate the frozen CID profile at every ingress

[hartsock]

What this PR does

Enforces the frozen ContentId profile — CIDv1 + dag-cbor (0x71) + BLAKE3
(0x1e) + a 32-byte digest — at every ingress, closing a hole surfaced by the
README/STABILITY cleanup (#72): the "fixed-profile newtype" promise held for
minted ids but not for parsed/converted ones, and a foreign CID could reach a
presentation accessor and panic.

The hole

from_canonical_bytes / from_canonical_bytes_checked / from_blake3_content_digest
always produce the profile. But from_bytes, FromStr, binary Deserialize, and
impl From<Cid> wrapped whatever the inner Cid accepted — no version/codec/hash/
digest-length check. A well-formed foreign CID (CIDv0, non-dag-cbor codec, SHA-256
hash, or non-32-byte digest) could therefore become a ContentId and then hit the
.expect(…) in digest_bytes() / digest_hex(). Python inherited it via
ContentId.parse / from_bytes and decoded IPLD (tag-42) links.

The fix

• validate_profile(&Cid) checks version == V1, codec == 0x71,
  hash().code() == 0x1e, hash().digest().len() == 32.
• All ingress routes through it: from_bytes, FromStr, binary Deserialize,
  and a new TryFrom<Cid> that replaces the infallible From<Cid>. The
  outward From<ContentId> for Cid is unchanged (dropping the newtype is safe).
• New additive ContentError::InvalidCidProfile { reason } (the enum is
  #[non_exhaustive], so this is not a breaking change).
• Python: the decoded-link path uses try_from and raises ValueError; parse /
  from_bytes inherit the core validation.
• digest_bytes() is now provably total — its expect is unreachable for any
  ContentId, not just minted ones.

Breaking change (deliberate, pre-0.1.0)

impl From<Cid> for ContentId → impl TryFrom<Cid>. It has no in-crate callers
(the full Rust gate is green), and it is made before the 0.1.0 freeze precisely
so 0.1.0 ships the enforced invariant rather than a promise the type doesn't keep.

Test plan

• Rust (content_id::profile_validation_tests): CIDv0/SHA-256, a non-dag-cbor
  codec, a SHA-256 hash, a non-32-byte digest, and a foreign CID link in dag-cbor
  are each rejected across TryFrom / from_bytes / FromStr / Deserialize; an
  on-profile id still passes every path. 6 tests, all green.
• Python (tests/test_profile_validation.py, run by CI's python job):
  from_bytes / parse / from_canonical_dagcbor-link reject a foreign CID;
  positive round-trip preserved.
• Full gate green locally: cargo fmt --check, clippy --all-features -D warnings,
  cargo test --all-features, cargo doc --all-features.

Out of scope

No change to the CID byte profile, the canonical encoding, the presentation forms,
or any minting path. The docs PR #72 (which named the invariant) should rebase on
this and can then merge; the stale source doc-comment that over-attributed the
tag-42 golden (flagged during #72 review) can be reconciled separately.