chore(lint): drain the standing violation baseline

[forkwright]

Summary

Drains the standing basanos violation baseline (12 → 1, and that one — NIX/flake-lock-committed — resolves when #706 merges, taking the workspace to zero). Per the operator's standing rule that the baseline and suppressions are in scope.

Real fixes:

• paroche/routes/download.rs: ReleaseMetadata gains a validating constructor — non-empty title/URL enforced once at the persistence boundary; both construction sites (HTTP route, MCP bridge) now go through it. ReleasePersistError is #[non_exhaustive] with a new EmptyMetadata variant and a forward-safe wildcard arm in the bridge's match.
• eksetasis/rate_limit.rs + komide/fetch.rs: the two genuinely wall-clock tests rewritten — paused-clock + tokio::time::timeout as the bound. Same properties asserted (prompt cancel-unblock; client timeout beats a stalled server), no Instant::now() measurement.
• CONTRIBUTING.md / docs/integrations.md: internal .lan FQDN literals replaced (placeholder for the forge host; reserved example.com domain for the KOReader examples).

Suppressions (each with a WHY):

• search/tests.rs wall-clock: the assertion measures tokio::time::Instant under an explicitly paused clock — virtual time, deterministic by construction; the rule's flake concern doesn't apply.
• gate-attestation.yml unpinned-action: forkwright/.github is fleet-owned and @main is the deliberate single-update channel for the shared hybrid gate (9 of 10 fleet repos call it this way).

Cruft deleted: four stale suppression entries that matched no files (an as-cast glob for a moved module, a checksum glob, a dep-count entry, and a per-crate ignore file whose suppressed field was removed in #575).

Verification

cargo test -p eksetasis: 316 passed; 0 failed
cargo test -p komide:     82 passed; 0 failed
cargo test -p paroche download: 33 passed; 0 failed
cargo test -p archon mcp_bridge: 28 passed; 0 failed
cargo check -p paroche -p archon: clean
cargo fmt --check: clean
kanon lint: 2 remaining (flake.lock → #706; the two justified suppressions above)

Refs #705 (the full 159-entry suppression audit is its own campaign)