chore: repository hygiene, MSRV correction, and CI hardening

[salazarsebas]

Summary

A batch of open-source readiness improvements, grouped into atomic commits for easier review:

• Style: replaced every em dash with standard punctuation across the repo (docs, source comments, tests, examples, vendored skill bundles).
• CLAUDE.md: new file pointing AI assistants (and by extension contributors) to the doc that governs each area (patterns, performance, unsafe policy, account kernel, privacy) plus concrete Soroban/Cougr non-negotiables (thin entrypoints, require_auth before mutation, no panics on caller-reachable conditions, standards layer over hand-rolled guards) and the required verification gate.
• README: added the live docs site link, and expanded the repository layout table to cover cougr-site/, internal/, packages/tokens/, tools/preview-gen/, skills/, and scripts/, which weren't documented before.
• Hygiene: removed a stale, unreferenced duplicate of murdoku.yml from the repo root (GitHub Actions only reads .github/workflows/, so it never ran), and a .gitignore line that was a typo of docs/ and matched nothing.
• MSRV fix: the declared rust-version (1.70.0 in some crates, 1.82.0 in others) hadn't matched reality for a while. Verified empirically with real toolchains: 1.79 fails (edition2024 required), 1.85 fails (darling/serde_with need 1.88), 1.88 builds the whole workspace cleanly. Corrected rust-version in all 6 crates that declared it, updated the 10 example READMEs still citing 1.70, and added a dedicated MSRV job pinned to 1.88.0 in core.yml so this can't silently drift again.
• Drop wee_alloc: it was cougr-core's own direct dependency (not transitive), flagged unmaintained with known memory leaks (RUSTSEC-2022-0054), no safe upgrade available. Replaced with soroban-sdk's own alloc feature, a bump-pointer allocator purpose-built for Soroban's run-to-completion invocation model, which the SDK's own docs recommend over a custom allocator. Verified: full workspace test suite passes, and spawn_and_move's compiled WASM is 44 bytes smaller with no regression.
• Clippy drift fix: while verifying -D warnings with a newer toolchain, found 12 pre-existing manual_is_multiple_of violations in src/zk/merkle/{tree,sparse}.rs, unrelated to this PR's diff but real and about to start failing once CI's stable catches up. Fixed alongside.
• Skill update: skills/cougr-game-starter scaffolded projects by hand-writing a Cargo.toml and contract skeleton, duplicating what the CLI now does. Rewired it to invoke cougr new <name> --template <template>, matching what docs/strategy/11-skills-strategy.md already called for once the CLI shipped.
• CI: added pr-check.yml, a path-filter-free workflow (fmt, no committed build artifacts, no conflict markers) so branch protection has something that reliably runs on every PR to require. Added cargo-deny.yml (advisories, licenses, bans, sources), PR-triggered only. Three RUSTSEC advisories are transitive through soroban-sdk/soroban-env-host (paste, yanked spin, derivative) with no fix available on our side, documented in deny.toml with the reason instead of failing indefinitely.
• Renovate: extended the auto-generated renovate.json (merged via chore: Configure Renovate #313) with dependency grouping (cargo/npm/github-actions) and weekly lockfile maintenance.

Branch protection on main, repo topics, and GitHub Discussions were also set up as part of this pass, directly via repo settings (not part of this diff).

Verification

• cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, and cargo test --workspace --features testutils all pass on the root workspace.
• All 30 example crates touched by the em-dash pass were individually re-verified (fmt, clippy, build, test); 28/30 pass cleanly. The two exceptions (fog_explorer clippy, hidden_hand fmt) are pre-existing and outside this PR's diff; circuit_examples.yml, the only workflow covering those two, only runs cargo test + stellar contract build for them (no fmt/clippy gate exists there today), and both of those pass.
• mdbook test and mdbook build verified locally with the exact pinned versions CI uses (mdbook 0.4.43, mdbook-linkcheck 0.7.7), including the sync-then-diff check cougr-site.yml runs.
• node build.js --check for design tokens passes against the updated docs/BRAND.md.
• The CLI's ignored generated_projects_pass_cargo_test test (compiles all 4 cougr new templates) passes.

Known non-blocking gap

fog_explorer and hidden_hand (along with dice_duel and blind_auction) are only covered by circuit_examples.yml's matrix job, which never runs fmt/clippy on them. Worth a follow-up to close that gap; not addressed here since it's a pre-existing hole in CI coverage rather than something this PR introduces.