ci: add safe reusable full verification

[Florious95]

Summary

• add reusable read-only Linux/macOS full Rust verification for pull requests and integration pushes
• route Publish npm through the reusable verification result
• preserve package checks and keep all npm publishing tag-only

Verification

• Ruby YAML syntax/static workflow policy checks
• destruction teeth for command, fail-fast, permissions, tag gate, and verify dependency
• incremental YAML architecture gate and dry tag dependency graph

Per PR development intentionally did not dispatch full Linux/macOS verification, run Grok full, or run complete GitHub CI.