ci(s4): file S4 loop-closure weekly CI workflow (#259)

## Summary

- Adds `.github/workflows/s4-loop.yml`: weekly Monday 04:00 UTC job
(plus `workflow_dispatch`) that brings up
`ghcr.io/hyperpolymath/verisimdb-api:latest` as a service container and
runs `just test-s4-loop`.

This was sitting in `docs/handover/S4-LOOP-CLOSURE-RUNBOOK.md` pending a
published verisimdb-api image. That image now exists (verisimdb PR
#121), so it's filed.

## Test plan

- [ ] Trigger via `workflow_dispatch` to confirm the service container
comes up and the s4_loop_closure test runs (skip path if VeriSimDB
unreachable, green if it is)
- [ ] Merge once green

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/s4-loop.yml

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: MPL-2.0
+# S4 loop-closure CI — brings up verisim-api as a service container and
+# runs the echidna s4_loop_closure integration test.  Filed once
+# ghcr.io/hyperpolymath/verisimdb-api:latest became available (PR #121).
+# Runs on schedule (Mondays 04:00 UTC) and on demand; not on every PR
+# (the test is a Tier-3 weekly cadence check, not a PR gate).
+name: S4 Loop Closure
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 4 * * 1'
+permissions:
+  contents: read
+jobs:
+  s4-loop:
+    name: S4 Loop Closure
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    services:
+      verisim:
+        image: ghcr.io/hyperpolymath/verisimdb-api:latest
+        ports:
+          - '8080:8080'
+        options: >-
+          --health-cmd "curl -sf http://localhost:8080/health"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      VERISIM_URL: http://localhost:8080
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
+        with:
+          toolchain: stable
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2
+      - name: Install just
+        uses: taiki-e/install-action@4bc351f7f2614e48088386e2a0ad917ca3a7e4ba # v2.81.5
+        with:
+          tool: just@1.51.0
+      - name: Install system dependencies
+        run: sudo apt-get install -y libssl-dev pkg-config
+      - name: Run S4 loop-closure test
+        run: just test-s4-loop