ci: define and enforce the Zig toolchain policy

Summary

• migrate build argument passthrough, sentinel allocation, and struct reflection to the current Zig 0.17 development APIs
• pin required CI jobs to the exact version in .zig-version
• add a non-blocking scheduled and manual latest-Zig compatibility job
• document the supported-toolchain and upgrade policy

Verification

• zig fmt --check .
• zig build
• zig build test
• zig build examples
• zig build -Dtarget=x86_64-linux-gnu
• documentation generation with zig build-lib -femit-docs
• Pantry dry-run for the pinned Zig version
• workflow YAML parse check

Closes #8