refactor: Wave 5 mechanical bundle — Java breadcrumb strip + io_loop verify + api-redesign reconcile + MSRV + semver-checks CI (refs #500)

[userFRM]

Five mechanical items from the audit follow-up, batched into one
9.0.1 patch bump. Refs #500. (PR 1 of 3 closing #500; PR 2 ships
property tests, PR 3 ships typed Error.)

A. Java RE breadcrumbs (audit §2.7)

Stripped 76 per-line // Source: PojoMessageUtils..., // Java: ...,
(FPSSClient.foo()) references across crates/, tools/, ffi/.
ADR-001 (docs/architecture/ADR-001-java-terminal-parity.md) is the
institutional anchor; per-line refs were dead scaffolding from the
original RE pass. Module-header parity prose collapses to one
See ADR-001 (...) line in fpss/mod.rs, fpss/connection.rs,
fpss/protocol/mod.rs, fpss/protocol/wire.rs,
mdds/decode/error.rs, config/mdds.rs. Final scrub returns zero
hits — well under the audit's "≤ 5" budget. Three contract codec
tests rename java_parity_* → wire_parity_* so the surviving
identifiers match the rest of the vocabulary.

B. io_loop.rs verify (audit §2.9)

Three concerns: login handshake (wait_for_login + LoginResult),
the main blocking-read + Disruptor-publish + command-drain loop with
auto-reconnect, and the ping heartbeat scheduler. Split into
io_loop/{mod.rs, login.rs, ping.rs}. login + ping each lift with
their own state and tests; the main loop body stays in mod.rs
because it owns the session state machine (frame buffer,
FrameReadState, delta state, contract cache, reconnect attempt
counter, Disruptor producer) which doesn't decompose without leaking
state across module boundaries. Test coverage moves with the
function under test — the eight wait_for_login_* tests live in
io_loop/login.rs, the four reconnect / MAX_RECONNECT_ATTEMPTS
tests stay in io_loop/mod.rs.

pinning.rs has two callsites (fpss/connection.rs +
flatfiles/mdds_spki.rs reuses the FPSS_SPKI_SHA256 digest), so
it stays separate. Folding it into io_loop would force every
flatfiles consumer to import the FPSS I/O module purely for the SPKI
constant — wrong dependency direction.

C. docs/public-api-redesign.md

Fully superseded by v9.0.0: the two-layer exact + ergonomic surface,
typed scalars (Date, Year, Right, Expiration, Strike,
TimeOfDay, Interval), IntoOptionSpec, for_contracts(...), and
StrikeSelector / ExpirationSelector wildcards all shipped on the
9.0.x line. The doc's proposed cadence ("v6.x additive façade ...
v8.0 remove compat") is moot. Deleted; new
docs/architecture/README.md indexes the ADR set and records that
planning prose for shipped surfaces is intentionally not preserved.

E. MSRV declaration

Empirical floor is rustc 1.88, not the prior rust-version = "1.85" declaration — transitive deps time 0.3.47, time-core 0.1.8, time-macros 0.2.27, the icu_* 2.2.0 family already require
>= 1.86 / >= 1.88, so a cargo +1.85 check --workspace errors out
at the dep graph. Bumped:

• [workspace.package].rust-version = "1.88" covers tdbe,
  thetadatadx, tools/cli, ffi via rust-version.workspace = true.
• tools/server, tools/mcp, sdks/python, sdks/typescript
  declare rust-version = "1.88" directly (each is excluded from the
  root workspace).
• CI Lint (...) job grows a toolchain matrix axis pinned to
  stable + 1.88 on the Linux runner so dependency bumps that raise
  the rustc requirement fail before release.
• README.md adds a Requirements section.

While the floor is touched, tdbe::codec::fie swaps len % 2 == 0
for len.is_multiple_of(2), which stable clippy 1.94 flags as
manual_is_multiple_of. is_multiple_of was stabilized in 1.87, so
the MSRV bump makes the rewrite safe.

F. cargo-semver-checks CI gate

New Semver check job runs obi1kenobi/cargo-semver-checks-action@v2
against the v9.0.0 tag on every PR. Verified locally — both tdbe
(196 checks) and thetadatadx (222 checks) pass with zero breakage
and no false-positives, so no #[doc(hidden)] suppressions needed.
CONTRIBUTING.md documents the public-API stability policy and the
local invocation.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings (stable + 1.88 floor)
• cargo test --workspace --locked
• cargo deny check
• cargo run -p thetadatadx --bin generate_sdk_surfaces --features config-file -- --check
• cargo check --manifest-path tools/cli/Cargo.toml --locked
• cargo check --manifest-path tools/mcp/Cargo.toml --locked
• cargo clippy --manifest-path tools/mcp/Cargo.toml --all-targets -- -D warnings
• cargo test --manifest-path tools/mcp/Cargo.toml --no-run
• cargo check --manifest-path tools/server/Cargo.toml --locked
• cargo check --manifest-path sdks/python/Cargo.toml --locked
• cargo check --manifest-path sdks/typescript/Cargo.toml --locked
• python3 scripts/check_version_sync.py → version sync: ok
• cargo +1.88 check --workspace --locked
• cargo semver-checks check-release --baseline-rev v9.0.0 →
  tdbe: 196 pass, thetadatadx: 222 pass, no breakage.

Refs #500.