Production readiness: canonical pipeline, support contract, cache safety

[godofecht]

Why

Azazel had enough implementation depth for serious use, but the repository still contained production blockers: the root CLI reimplemented an older subset of the build language, export.cue silently dropped supported module fields, the determinism check no longer forced regeneration after codegen memoization was added, package metadata omitted the canonical CLI, the public docs described an obsolete schema, and the shared-cache documentation made a stronger correctness claim than its current key can justify.

What this changes

• Makes gen_build_spec.sh the single CUE -> Zig generator; azazel now orchestrates that canonical path rather than reimplementing it.
• Fixes export.cue so option_values and gen_imports survive into the resolved build model.
• Makes azazel check validate the full exported module contract, source roots, dependency references, and cycles.
• Runs the canonical CLI in CI on Zig 0.14.1, 0.15.2, and 0.16.0 and forces a genuine second generation for determinism.
• Adds static checks, builds the generated documentation site in CI, and adds a macOS smoke lane on Zig 0.16.0.
• Documents the current macOS boundary: Zig 0.15.2 fails to link its build runner on the hosted macOS 26 arm64 image, so 0.15.2 remains Linux-covered rather than being represented as a macOS guarantee.
• Gates the shared artifact cache behind AZAZEL_EXPERIMENTAL_CACHE=1, removes the unsupported stale-hit impossibility claim, and includes the Azazel engine/config files in the experimental key.
• Adds a production support/release contract, contributor contract, and security policy.
• Rewrites README, Getting Started, docs index, and the Pages source around the stable build-model/IR proposition and explicit experimental boundaries.
• Fixes build.zig.zon to ship the canonical CLI and production policy files, and aligns its minimum Zig version with the supported 0.14.1 floor.

Production boundary after this PR

Supported: CUE validation -> resolved model -> generated typed spec -> Zig executor, through the canonical CLI/direct generator path on the declared stable Zig lanes.

Experimental: shared remote cache, corpus automation, IDE prototypes, and Danzig as dogfood/integration workload.

Follow-up production work

• Production blocker: generalize typed dependency build options #44 generalize typed dependency build options instead of accumulating package-specific executor branches.
• Production adoption: make Azazel a centrally versioned dependency #45 make Azazel a centrally versioned dependency so consumers do not copy the compatibility engine.
• Production blocker: prove complete cache input closure before ungating #46 prove complete cache input closure before the shared cache is ungated.
• Repository focus: extract Danzig into a standalone dogfood project #47 extract Danzig into a standalone dogfood project and use it to prove the external adoption path.

Existing large-project roadmap issues #16, #18, #20, and #22 remain relevant to full build-graph replacement.