Add CI workflow with coverage gate and pin the Rust toolchain - #424

The default target now runs every check the release process expects:
formatting, clippy, the test suite with a 90% line-coverage floor,
doctests, and a release build. fmt checks and fmt-fix formats; lint
runs the fast format-and-clippy loop; help lists all targets. Update
README and DEVELOPMENT to match.

Remove the grcov exclusion marker comments; coverage is now measured
with cargo-llvm-cov, which does not read them, so they were inert.
Replace DeadlineJoiner::join's Result<T, ()> with a DeadlineExceeded
error type to satisfy clippy::result_unit_err.

Also fix test-suite portability issues surfaced by CI, and reject
0-byte tar bundles before invoking system tar: bsdtar (the system tar
on Windows) accepts an empty file as a valid archive, unlike GNU tar.

Also make the suite robust in environments beyond the CI runners:
tests that chmod a file or directory to force a denial skip under
root, which bypasses DAC checks entirely (the common case for
containerized runs); the SUID-strip extraction test skips under root,
where GNU tar deliberately honors setuid bits from archive headers;
the process-group cleanup test skips when PID 1 is a non-reaping
process (containers without an init), since unreaped zombies keep the
group alive from kill(0)'s perspective; and the IFS check retries
briefly on ETXTBSY, a fork/exec descriptor-inheritance race between
parallel test threads.