fix: review findings — honest labels, release guards, hermetic action

[vyncint]

Review sweep (8-finder pass plus targeted checks) before 1.0.2:

• A report with no measurements said measured; it now says unmeasured
  (schema value added, pinned by test) — the exact mislabeling the
  project's own rules forbid.
• The release workflow refuses to publish when the pushed tag disagrees
  with Cargo.toml, reads the version deterministically instead of
  packages[0], and warns loudly on manual dispatch. GitHub's * matches
  any characters, so the trigger glob alone never was a barrier; now it is
  defense-in-depth.
• Every action step pins RUSTUP_TOOLCHAIN: a rust-toolchain.toml in the
  consumer's checkout could hijack the launchbound install (and previously
  the gate). The toolchain contract — your kernel is analyzed under the
  action's toolchain, inherently — is documented on the input and in the
  action README, whose example now uses the floating @v1. A truncated or
  empty gate record surfaces the prune failure instead of a Python
  traceback.
• Lockstep pins are written once per workflow (env), the pin-watch issue
  names every site a bump must touch, and CONTRIBUTING gains the release
  checklist including the easy-to-forget floating-v1 move.
• rustdoc warnings fixed; orphaned internal section references in
  docs/research-baseline.md reworded for public readers. Version 1.0.2.

Signed-off-by: Vyncint Ng vyncint@icloud.com