Adopt the gha module: one gha:: recipe per CI job

[lann]

The websocket/webcrypto arrangement, adopted here: CI job bodies live in .github/justfile (the gha module), each workflow job runs exactly one just gha::<job> recipe with per-recipe log groups and failure annotations, and just ci is exactly CI. The workflows carry no logic beyond environment setup.

• ci.yml's four jobs each collapse to one gha:: step (rust-checks, smoke, conformance-checks, interop); every previous run: just … line survives as a _step inside the corresponding job recipe, same order.
• timing-lab-scheduled moves into the gha module (workflow-only plumbing, the webcrypto placement); timing-lab.yml invokes just gha::timing-lab-scheduled. The lab stays schedule-only and outside ci.
• default lists recipes, so bare just no longer runs check — the family convention.
• AGENTS.md's checks table gains the just ci row.

Verified: every gha::_step target dry-run-resolves; the _step wrapper exercised in local passthrough, GHA log-group, and failure-annotation modes; workflows parse; just fmt-check passes. The substantive gate is this PR's CI, which runs exactly the recipes it always ran, now through the gha module.