Prepare 0.9.1 safe SIMD release

[jcwal1516]

Summary

• prepare the workspace and reviewed public-API evidence for 0.9.1
• refactor j2k-jpeg CPU SIMD dispatch and kernels behind capability-carrying safe boundaries
• reduce production JPEG CPU SIMD to 10 audited private unsafe blocks and zero unsafe fn declarations
• upgrade fearless_simd to 0.7.0 while retaining the existing exact-AVX2 acceleration envelope
• add deterministic decode and expanded SIMD microbenchmarks plus repository unsafe-boundary ratchets

Why

CPU feature kinds were forgeable and ordinary SIMD dispatch, wrappers, and kernel calls exposed a much larger unsafe surface than necessary. The new design carries genuine runtime capabilities, keeps dispatch outside hot loops, and confines target-feature and fixed-size memory operations to small audited modules.

Validation

• cargo xtask test
• cargo xtask clippy-strict
• cargo xtask doc
• cargo xtask release-cpu on macOS AArch64, Linux x86-64, and Windows x86-64
• cargo xtask unsafe-audit
• cargo xtask repo-lint
• cargo xtask semver
• cargo xtask stable-api
• cargo xtask bench-build --lane host
• cargo xtask fuzz-build and bounded runs of all 14 fuzz targets
• cargo deny check licenses advisories bans sources
• cargo xtask package from commit a9343a2e786fc3cc04b2df4da71445216676165d

Remaining release gates

• repeat the fearless_simd 0.7 AArch64 Criterion comparison on a clean idle host before making a direct measured no-regression claim
• complete hosted exact-SHA CI, coverage, T.803, and applicable GPU evidence after candidate freeze
• date the changelog only in the final candidate-freeze edit, as required by the release guide