ci: migrate 2 of 9 ci jobs to smithy self-hosted runners

[avrabe]

Summary

This is a Bazel rules repo bridging Rocq (Coq) and Rust. Per the
smithy migration playbook,
neither Bazel nor Coq/Rocq are installed on the smithy fleet, so the
migrable surface is small: every job that compiles or queries Bazel
targets stays on ubuntu-latest, and the macOS matrix entry stays
on macos-latest (smithy is Linux-only). Following the same
per-job approach as pulseengine/spar#201, pulseengine/rivet#262, and
pulseengine/kiln#247.

Coverage

Class	Jobs
light	buildifier (ci.yml), docs (docs.yml)
(hosted)	7 others (Bazel/Nix/Rocq/macOS/reusable)

Stays on hosted (each commented in-place)

Job (file)	Reason
verify-rules (ci.yml)	runs bazel query; Bazel not on smithy
build (ci.yml)	needs Nix + Bazel + Rocq toolchain
build-macos (ci.yml)	smithy is Linux-only
verify-multiplatform (ci_comprehensive.yml)	Bazel + macOS matrix
quick-test (quick_test.yml)	runs bazel query
release (release.yml)	release step runs bazel build
publish (publish.yml)	reusable workflow from bazel-contrib

Workarounds applied

None. The two migrated jobs are clean drop-ins:

• buildifier: curls a static buildifier-linux-amd64 binary and
  runs --mode=check -r .. No sudo, no apt, no Bazel invocation
  (the setup-bazelisk step is harmless on smithy and is left
  in-place to keep the diff minimal).
• docs: shell grep checks on README plus
  npm install -g markdown-link-check. Smithy ships Node LTS via
  nvm with a writable global prefix, so the global install needs no
  sudo.

Test plan

• CI run completes; buildifier and docs jobs land on light smithy runners
• No EACCES events in smithy's journalctl -u smithy-trace-eacces.service during the run
• Hosted jobs (verify-rules, build, build-macos, verify-multiplatform, quick-test) continue to pass as before
• npm install -g markdown-link-check resolves to nvm's prefix (no permission error)

Rollback

Revert this commit. Every job's runs-on: flips back to
ubuntu-latest / macos-latest and the next run uses GitHub-hosted
compute.

Follow-ups (out of scope here)

• Bazel, Coq/Rocq, and Nix are tracked as open items in the
  smithy playbook's "out of scope" table. When smithy's toolchains
  role grows them, the seven hosted jobs above become candidates
  for migration in a follow-up PR.