feat(library): new ipv4/ipv6/iso_date/zip_code/email_rfc_5322 validators + real-world corpus hardening + guarantee docstrings (#283)

Ships the validator-hardening epic and splits the bench-baseline
regenerate job into its own workflow.

## New validators

- **`ipv4`** — strict IPv4 dotted-quad. Splits the shape out of the
unified `ip` for callers who need v4-only.
- **`ipv6`** — every documented IPv6 form: full 8-group,
`::`-compressed, link-local `%zone`, IPv4-mapped `::ffff:1.2.3.4`, and
the hybrid IPv4-suffix. Splits the shape out of `ip` the same way.
- **`iso_date`** — strict ISO 8601 date shape `YYYY-MM-DD`. Distinct
from the existing `datetime` (which includes a time component) and the
loose `date` (which accepts many separators).
- **`zip_code`** — US ZIP or ZIP+4 postal-code shape.
- **`email_rfc_5322`** — the strict RFC 5322 mailbox subset already
inside `email`, exposed as its own callable so downstream callers can
pick permissive vs strict semantics without composing themselves.

## Real-world corpus hardening

- **`tests/library/corpora/<name>.toml`** — per-validator TOML files
with `accepts` and `rejects` lists (233 cases across 14 validators).
Adding a new validator just means dropping in a new TOML.
- **`tests/library/hardening.test.py`** — parametrized test that walks
every corpus file, resolves the validator from `edify.library`, and
asserts the boolean verdict matches the expected side. `pytest -k
hardening` runs the whole corpus in under half a second.
- Coverage: `email`, `email_rfc_5322`, `url`, `ipv4`, `ipv6`, `mac`,
`uuid`, `guid`, `ssn`, `date`, `iso_date`, `phone`, `zip_code`,
`password`.

## Guarantee documentation pass

- Every hardened validator's module docstring now spells out what it
does and does not guarantee — shape vs semantics, anchoring, case
sensitivity, structural exclusions. Callers no longer have to grep the
regex or read the source to know whether `mac(...)` accepts EUI-64 or
whether `iso_date(...)` validates calendar correctness.
- The `password` validator gets a first-class guarantee block covering
the default policy (min length, class thresholds, special-char set) and
the passphrase-strength and non-ASCII limits it deliberately does not
check.

## CI hygiene — split bench-baseline job

- The `bench: regenerate runner baseline` job moves out of `build` into
its own `.github/workflows/bench-baseline.yml`. It only registers when
workflow_dispatch fires with a typed `YES` confirmation.
- Every push and pull_request stops surfacing the two skipped
baseline-regen checks that were appearing on every commit.
- The runtime behavior is unchanged: baselines are still
runner-generated and committed back with `contents: write` permission.

Closes #78, closes #152, closes #153, closes #156, closes #157, closes
#158, closes #159, closes #160, closes #161, closes #162, closes #163,
closes #164, closes #165, closes #166, closes #167, closes #168, closes
#169.

0 files changed, 0 insertions, 0 deletions