feat(library): new ipv4/ipv6/iso_date/zip_code/email_rfc_5322 validators + real-world corpus hardening + guarantee docstrings (#283)

Ships the validator-hardening epic and splits the bench-baseline
regenerate job into its own workflow.

## New validators

- **`ipv4`** — strict IPv4 dotted-quad. Splits the shape out of the
unified `ip` for callers who need v4-only.
- **`ipv6`** — every documented IPv6 form: full 8-group,
`::`-compressed, link-local `%zone`, IPv4-mapped `::ffff:1.2.3.4`, and
the hybrid IPv4-suffix. Splits the shape out of `ip` the same way.
- **`iso_date`** — strict ISO 8601 date shape `YYYY-MM-DD`. Distinct
from the existing `datetime` (which includes a time component) and the
loose `date` (which accepts many separators).
- **`zip_code`** — US ZIP or ZIP+4 postal-code shape.
- **`email_rfc_5322`** — the strict RFC 5322 mailbox subset already
inside `email`, exposed as its own callable so downstream callers can
pick permissive vs strict semantics without composing themselves.

## Real-world corpus hardening

- **`tests/library/corpora/<name>.toml`** — per-validator TOML files
with `accepts` and `rejects` lists (233 cases across 14 validators).
Adding a new validator just means dropping in a new TOML.
- **`tests/library/hardening.test.py`** — parametrized test that walks
every corpus file, resolves the validator from `edify.library`, and
asserts the boolean verdict matches the expected side. `pytest -k
hardening` runs the whole corpus in under half a second.
- Coverage: `email`, `email_rfc_5322`, `url`, `ipv4`, `ipv6`, `mac`,
`uuid`, `guid`, `ssn`, `date`, `iso_date`, `phone`, `zip_code`,
`password`.

## Guarantee documentation pass

- Every hardened validator's module docstring now spells out what it
does and does not guarantee — shape vs semantics, anchoring, case
sensitivity, structural exclusions. Callers no longer have to grep the
regex or read the source to know whether `mac(...)` accepts EUI-64 or
whether `iso_date(...)` validates calendar correctness.
- The `password` validator gets a first-class guarantee block covering
the default policy (min length, class thresholds, special-char set) and
the passphrase-strength and non-ASCII limits it deliberately does not
check.

## CI hygiene — split bench-baseline job

- The `bench: regenerate runner baseline` job moves out of `build` into
its own `.github/workflows/bench-baseline.yml`. It only registers when
workflow_dispatch fires with a typed `YES` confirmation.
- Every push and pull_request stops surfacing the two skipped
baseline-regen checks that were appearing on every commit.
- The runtime behavior is unchanged: baselines are still
runner-generated and committed back with `contents: write` permission.

Closes #78, closes #152, closes #153, closes #156, closes #157, closes
#158, closes #159, closes #160, closes #161, closes #162, closes #163,
closes #164, closes #165, closes #166, closes #167, closes #168, closes
#169.

2 files changed, 38 insertions, 39 deletions

diff --git a/.github/workflows/bench-baseline.yml b/.github/workflows/bench-baseline.yml
new file mode 100644
index 0000000..8eb0743
--- /dev/null
+++ b/.github/workflows/bench-baseline.yml
@@ -0,0 +1,37 @@
+name: 'bench baseline regenerate'
+on:
+  workflow_dispatch:
+    inputs:
+      confirm:
+        description: 'Type YES to confirm regenerating tests/bench/baseline.json on the runner and committing it back'
+        required: true
+        default: 'no'
+jobs:
+  regenerate:
+    name: 'bench: regenerate runner baseline'
+    runs-on: ubuntu-latest
+    if: github.event.inputs.confirm == 'YES'
+    permissions:
+      contents: write
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        with:
+          python-version: '3.11'
+      - name: install dependencies (includes bench group)
+        run: uv sync --frozen --all-groups
+      - name: generate baseline.json on the runner
+        run: |
+          uv run pytest tests/bench/ --benchmark-only --benchmark-json=tests/bench/baseline.json
+      - name: commit the runner-generated baseline back to the branch
+        run: |
+          git config user.name 'edify-ci[bot]'
+          git config user.email '[email protected]'
+          git add tests/bench/baseline.json
+          git diff --cached --quiet && exit 0
+          git commit -m 'chore(bench): regenerate runner-generated baseline'
+          git push
diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml
index 519dc64..c0ed6e2 100644
--- a/.github/workflows/github-actions.yml
+++ b/.github/workflows/github-actions.yml
@@ -1,13 +1,5 @@
 name: build
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      regenerate_bench_baseline:
-        description: 'Regenerate the runner-generated bench baseline and commit it back to the branch'
-        required: false
-        default: 'false'
+on: [push, pull_request]
 jobs:
   test:
     name: ${{ matrix.name }}
@@ -142,7 +134,6 @@ jobs:
   bench:
     name: 'bench (advisory)'
     runs-on: ubuntu-latest
-    if: github.event_name != 'workflow_dispatch' || github.event.inputs.regenerate_bench_baseline != 'true'
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -160,32 +151,3 @@ jobs:
           else
               uv run pytest tests/bench/ --benchmark-only || true
           fi
-
-  bench-baseline-regenerate:
-    name: 'bench: regenerate runner baseline'
-    runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.regenerate_bench_baseline == 'true'
-    permissions:
-      contents: write
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
-        with:
-          python-version: '3.11'
-      - name: install dependencies (includes bench group)
-        run: uv sync --frozen --all-groups
-      - name: generate baseline.json on the runner
-        run: |
-          uv run pytest tests/bench/ --benchmark-only --benchmark-json=tests/bench/baseline.json
-      - name: commit the runner-generated baseline back to the branch
-        run: |
-          git config user.name 'edify-ci[bot]'
-          git config user.email '[email protected]'
-          git add tests/bench/baseline.json
-          git diff --cached --quiet && exit 0
-          git commit -m 'chore(bench): regenerate runner-generated baseline'
-          git push