compat gate: HEAD sample sealer + published pg-core reader crate

[rubenhensen]

Sub-issue of #251 (epic #247, workstream C). Rust half of the gate.

• Sample sealer: a small internal tool (pg-core example or xtask) that seals deterministic payloads with HEAD in both modes (memory + stream), emitting bytes + keys as artifacts.
• Reader side: a compat-test crate OUTSIDE the workspace depending on published pg-core versions from crates.io (per the support window in COMPATIBILITY.md: declare endpoint stability, archival read guarantee, SDK support windows, deprecation process #252, starting with =0.6.1) that opens those artifacts.
• Workflow job wire-compat-rust, path-filtered to pg-core/** and pg-wasm/**.

Done when: the job is green on main, and a deliberate header/serialization change on a test branch turns it red.

[rubenhensen]

/dobby please pick this up — spec in the issue body: a deterministic sample sealer (pg-core example or xtask) sealing in both modes with HEAD, and a compat-test crate OUTSIDE the workspace that opens those bytes with published crates.io pg-core (start with =0.6.1; the #252 window will formalize the list). Workflow YAML as a PR comment per the usual pattern — a maintainer lands it. Its sibling #261 (Node old-reader half) builds on your artifact layout, so document the artifact shape clearly. Part of #247 (workstream C).

[dobby-coder]

On it — I'm building a deterministic sample sealer (sealing in both modes, pinned to HEAD) plus a compat-test crate outside the workspace that opens those artifacts with published pg-core =0.6.1. I'll document the artifact layout clearly so #261's Node old-reader work can build on it, and drop the workflow YAML as a PR comment per the usual pattern.

[dobby-coder]

Done — signed off postguard#265 and flipped it to ready for review.

The cycle-1 SIGABRT-kills-the-run blocker is fixed at the root: each compat case now runs in its own pg-compat-case child process, so one aborting reader only loses its own case instead of the whole run. Re-ran that repro on the branch to confirm.

Full rule sweep on the delta (Rust, CI, patch-in-comment, PR-process, prose) came back clean — no bugs. I fixed the three nits directly instead of another round trip: the wire_version guard now covers the child process path too, the README's stale "no timestamp" claim is corrected (the manifest does carry sender.public.ts/sender.private.ts for #261, still deterministic), and .gitignore now covers core.<pid> dumps. cargo fmt/clippy -D warnings clean and all 21 CI checks green.

Still open for a maintainer: the wire-compat-rust job YAML is sitting in the PR comment and needs to be applied — nothing gates the wire format until that lands. Also flagged, but out of scope for this PR: Unsealer::new aborts the process on a malformed header instead of returning Err, which is pre-existing on main and worth its own issue for pg-pkg.