ci: Restore full CI job set for the standalone repo - #308

Migration only carried a tests-cli slice. Restores everything from
c2pa-rs's tier-1a.yml/beta-preflight.yml that still applies to a
single binary crate with no workspace and no backend-feature matrix:

- tests-cli, doc-tests, cargo-check, cargo-lock, clippy_check, cargo_fmt,
  cargo-deny, tests-wasi -- all adapted to drop the get-features job and
  its $FEATURES matrix (c2patool's own Cargo.toml hardcodes its c2pa
  backend feature already; it never selected one dynamically) and any
  --workspace flag (none survive in a single-crate repo).
- New docs-private job: cargo doc --document-private-items --no-deps,
  warnings denied. c2patool doesn't publish to docs.rs (binary, no public
  API), so docs_rs/docs_stable don't apply, but internal documentation
  (including private items) still needs to build cleanly.

Dropped entirely: get-features, tests-openssl, tests-rust-native-crypto,
tests-windows-arm-*, docs_rs, docs_stable, tests-wasm, tests-cross -- all
either SDK-only backend-matrix concerns or docs.rs-publish concerns that
don't apply to a binary crate.

NOTE: main's Cargo.toml currently depends on an unpublished c2pa
version (0.91.0-dev), so this CI cannot actually pass until that's fixed
(see the companion 'auto-track c2pa-rs main' PR).

std::process::id() panics under WASI (no process-ID concept in that
sandbox) rather than erroring, which crashed the whole test binary
(SIGABRT) the moment atomic_write_file_writes_and_replaces ran under
tests-wasi. Switched to a nanosecond timestamp instead -- verified
locally against the actual wasm32-wasip2 target with wasmtime, all 13
unit tests + 0 integration tests pass.

cargo llvm-cov --bins alone only measures the crate's own embedded unit
tests -- it excludes tests/integration.rs (38 tests) entirely, since
that's a separate [[test]] target, not a bin target. That was masking
most of the actual coverage: --bins alone reports 32%, matching what
was seen in the new repo; adding --tests brings it to 68-71% locally,
in line with the historical c2pa-rs figure for this code.

This flag scope already existed as-is in c2pa-rs's own tier-1a.yml
tests-cli job (not something the migration or this PR's restore
introduced) -- it just never surfaced as a problem there, likely
because Codecov's per-file report aggregates uploads from multiple
c2pa-rs CI jobs, only one of which is this narrowly-scoped one.

c2patool ships a Mac/Linux/Windows binary as its core product and has
real per-OS code (the cfg(windows) windows-sys dependency), unlike the
SDK crate this repo split from -- there, cross-platform testing is a
separate, more expensive Tier 1B/2 concern deliberately kept out of the
fast per-PR gate (Tier 1A/ci.yml stays ubuntu-only there). That
trade-off doesn't apply here: there's no other tier picking up
cross-platform coverage for c2patool, so it needs to be in the direct
gate. Coverage collection/Codecov upload stays ubuntu-only to avoid
three redundant uploads for the same run.

Verified locally on macOS: cargo test --bins --tests, 38 passed.