Harden state persistence browser smoke CI

[leehack]

Summary

• harden the state-persistence browser smoke so CI performs model-backed save/load round trips with integrity-checked tiny GGUF coverage
• add CI reliability contracts for Node 24 action runtime coverage, model cache path handling, smoke artifacts, and workflow/doc guardrails
• document maintainer/agent validation expectations across AGENTS.md, README.md, and CONTRIBUTING.md
• preserve worker-owned state semantics by avoiding silent fallback from worker state APIs to direct runtime state
• fix the CI workflow-validation failure caught after the first push by removing runner.temp from job-level env and extending the reliability contract to catch that regression

Production-readiness scope

• Users/maintainers get stronger CI coverage for direct and worker runtime state persistence paths.
• CI smoke diagnostics now preserve logs/result artifacts/screenshots when available, while avoiding raw signed/authenticated URL leakage.
• Public API behavior is unchanged; this PR only hardens tests, workflow reliability, and operational docs.
• Comprehensive public API reference documentation is intentionally deferred to Document the public LlamaWebGpuBridge API surface #11.

Test Plan

• python3 scripts/verify_ci_reliability.py
• python3 scripts/verify_state_persistence_api.py
• python3 -m py_compile scripts/verify_state_persistence_api.py scripts/verify_ci_reliability.py scripts/state_persistence_browser_smoke.py
• YAML parse checks for .github/workflows/ci.yml and .github/workflows/publish_assets.yml
• go run github.com/rhysd/actionlint/cmd/actionlint@latest -color=false .github/workflows/ci.yml .github/workflows/publish_assets.yml
• git diff --check
• static security scan for hardcoded secrets, dangerous exec, and raw URL logging patterns
• independent review; reviewer caught missing required-doc file I/O handling, fixed with reported contract errors instead of top-level tracebacks, then re-reviewed clean

CI notes

• Initial branch push failed before jobs were created because runner.temp is not available in job-level env.
• Fixed in b311334 and protected by scripts/verify_ci_reliability.py plus actionlint validation.

Downstream llamadart validation

• dart analyze lib/src/backends/webgpu test/integration/backends/webgpu
• dart test -p chrome test/integration/backends/webgpu/webgpu_engine_multimodal_browser_integration_test.dart
• tool/testing/playwright_bridge_smoke.py against PR Harden state persistence browser smoke CI #12 webgpu-bridge-dist artifact JS
• flutter build web --base-href=/example/chat_app/build/web/ in example/chat_app
• tool/testing/playwright_chat_app_real_model_smoke.py against built chat app with Qwen3.5-0.8B-Q4_K_M GGUF; response: 2+2 equals 4.

Closes #10

Follow-up: #11