ci: promote maintainability guardrail to blocking

[peters]

Summary

• make the maintainability CI job blocking instead of advisory
• refresh the maintainability docs to describe the now-empty baseline ledger
• mark the first maintainability cleanup wave as complete in the rollout plan

Behavior Impact

• new oversized Rust source files in crates/*/src now fail CI immediately unless a reviewed baseline entry is added
• no user-facing runtime behavior changes

Test Evidence

• ./scripts/check-maintainability.sh
• ./scripts/sync-surge-core-vendor.sh --check
• ./scripts/check-version-sync.sh
• cargo fmt --all -- --check
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes
• dotnet test dotnet/Surge.slnx --configuration Release

Migration Notes

• none