SIMD AVX2 path is unverified pre-merge (no x86 CI on the stack)

[coderdan]

Problem

The SIMD AVX2 kernel added in PR #81 (packages/ore-rs/src/primitives/simd.rs,
avx2::gt_mask_xor_256) is not exercised by any machine before merge:

• CI (.github/workflows/test.yml) runs only on push/pull_request to
  main. The ORE v2 stack PRs all target feature branches, so the stack
  (ORE v2 (2/n): core refactor — width abstraction, seed/tag separation, template RO keys #79–ORE v2 (6/n): chained-prefix variable-length scheme + string encryption #83) gets no CI until it reaches a PR into main.
• The dev/review host is aarch64 (Apple Silicon), so local cargo test
  exercises the NEON path, never AVX2.
• gt_mask_dispatched_matches_scalar / lsb_mask_dispatched_matches_scalar
  compare the dispatched kernel to scalar, i.e. only the host-native
  vector path: AVX2 on x86, NEON on aarch64 — never both. On x86,
  lsb_mask has no AVX2 path, so that test is a vacuous scalar-vs-scalar
  comparison there.

Net: an AVX2-only regression (e.g. the unsigned→signed bias trick, the
movemask/to_le_bytes bit order) could ship through the whole stack
undetected. (The AVX2 logic was verified by reasoning in the #81 review and
is believed correct; what's missing is machine verification.)

Resolution options

1. x86 CI gate before merge — ensure these tests run on an x86_64 runner
   (with AVX2) before ORE v2 (4/n): NEON + AVX2 SIMD backends #81 / the stack lands on main. Cheapest if CI already
   uses x86 ubuntu runners; just make sure the stack hits CI.
2. Host-portable verification — a test that validates the encoding logic on
   any arch, e.g. a forced-scalar vs portable-reference cross-check, so the
   bit-order/contract is pinned even on an aarch64-only dev box.
3. qemu / cross-run — run the AVX2 path under emulation in CI for
   defence-in-depth.

Acceptance

avx2::gt_mask_xor_256 is exercised (dispatched-vs-scalar) by CI on an x86_64
host with AVX2 before #81 merges to main, and the suite has some AVX2-vs-scalar
coverage that doesn't depend solely on the merge-to-main trigger.