ci: enforce 100% coverage, W3C XML conformance suite, and libFuzzer ASan smoke in CI

[nth-bailey]

Overview

Wires all newly developed security, conformance, and fuzzing capabilities into automated GitHub Actions CI.

Enhancements

1. Strict Test Coverage Enforcement:
   • Enforces --cov=safexml --cov-branch --cov-fail-under=100 across all matrix runners (Linux, macOS, Windows on Python 3.12–3.15).
2. W3C XMLTS 20130923 Conformance Step:
   • Executes python scripts/run_w3c_conformance.py on Linux, validating all 2,585 W3C test cases with zero permitted discrepancies.
3. libFuzzer ASan Smoke Job (fuzz-smoke):
   • Compiles and runs a 15-second live fuzzing smoke test with AddressSanitizer and fuzz/xml.dict using cargo +nightly fuzz run.
4. Differential Fuzzing Smoke:
   • Retains multi-platform 1,000-iteration differential fuzzing against ElementTree on all test matrices.