ci: check unnecessary public APIs with Hawk

[LukeMathWalker]

Why

Unnecessary public Rust APIs increase the workspace surface that must remain stable. Hawk provides closed-world visibility analysis across the workspace and can prevent new accidental public APIs.

What Changed

• pin Hawk 0.1.11 and its required Rust 1.97.1 toolchain
• add a standalone just hawk command and dedicated Linux CI job
• restrict 482 unnecessary public and restricted-visibility declarations reported across all workspace binaries
• deny actionable Hawk warnings while leaving hawk::dead_public advisory

Risks / Notes

• just hawk remains separate from just check because Hawk does not ship for Windows
• hawk::dead_public is allowed because host-only analysis cannot prove platform-specific APIs are dead; 27 advisory findings remain, including Windows-only surfaces
• hawk::unnecessary_crate_visibility remains disabled because pub(crate) versus pub(super) is an optional style policy

AI Assistance

Implemented with OpenAI GPT-5.6.