feat(verify): provable CI for the type-checker + render the Zig FFI

Slice 3 — propagate the chapeliser "provably-real + honest" pattern to
typedqliser (the #1 -iser priority).

Provable — add .github/workflows/provable.yml:
  - golden-check: the SQL type-checker ACCEPTS valid queries and REJECTS
    invalid ones (blog-api example; verified locally — good pass, bad fail
    at L1/L2/L3). The headline value, machine-checked.
  - zig-ffi: `zig build test` the C-ABI FFI (Zig 0.14, SHA-pinned action).

Make the Zig FFI real — it shipped as an UNRENDERED RSR template:
  - render {{project}}/{{PROJECT}} -> typedqliser across build.zig,
    src/main.zig, test/integration_test.zig.
  - build.zig: drop `lib.version` (versioned .so panics in Zig 0.14's
    InstallArtifact) and add linkLibC() (main.zig uses std.heap.c_allocator)
    — the same fixes proven on chapeliser.

Honest docs — the README sold an "Idris2 type kernel" as "the core", but
there are zero .idr files (src/abi/ is 54 lines of Rust):
  - reframe the level model as proof OBLIGATIONS enforced in Rust today,
    with the Idris2 kernel specified-but-unimplemented.
  - fix the Zig FFI path and the Status paragraph.

Rust layer unchanged (116 tests). The golden type-checker is verified
locally; the Zig build is CI-gated (no zig mirror reachable in the sandbox).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mbq6yKF9RhFai6EQ7WqKhQ

Author: claude

.github/workflows/provable.yml

@@ -0,0 +1,61 @@
+# SPDX-License-Identifier: MPL-2.0
+# Provable — machine-checks the claims TypedQLiser makes beyond unit tests.
+#
+#   1. golden-check — the type-checker ACCEPTS valid SQL and REJECTS invalid SQL
+#      (the blog-api example: good-queries pass, bad-queries fail at L1/L2/L3).
+#   2. zig-ffi      — the Zig C-ABI FFI builds and its unit tests pass.
+#
+# The Rust layer itself is covered by rust-ci.yml.
+name: Provable
+
+on:
+  push:
+    branches: [main, master, "claude/**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  golden-check:
+    name: TypedQL — accepts good SQL, rejects bad
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - name: Build
+        run: cargo build --quiet
+      - name: Positive — a valid query type-checks (exit 0)
+        working-directory: examples/blog-api
+        run: >-
+          ../../target/debug/typedqliser check
+          -q 'SELECT id, username, email FROM users WHERE id = $1' --ci
+      - name: Negative — invalid queries are rejected (exit non-zero)
+        working-directory: examples/blog-api
+        run: |
+          set -x
+          # syntax error (L1) must be rejected
+          ! ../../target/debug/typedqliser check -q 'SELEC * FORM users' --ci
+          # nonexistent column (L2) must be rejected
+          ! ../../target/debug/typedqliser check -q 'SELECT id, full_name FROM users' --ci
+      - name: Full example — good passes, bad fails
+        working-directory: examples/blog-api
+        run: |
+          out=$(../../target/debug/typedqliser check 2>&1 || true)
+          echo "$out"
+          echo "$out" | grep -q '2 queries checked, 1 passed, 1 failed'
+
+  zig-ffi:
+    name: Zig — build + test FFI
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: mlugg/setup-zig@53fc45b17fe98b52f92ee5ea08ff48a85a3e7eb7 # v1.2.2
+        with:
+          version: 0.14.0
+      - name: zig build + test
+        working-directory: src/interface/ffi
+        run: |
+          zig version
+          zig build test