Split CI into public and proprietary Bazel suites (#1200)

# Problem

Main CI currently runs public and proprietary Bazel suites together on a
self-hosted runner. This keeps open-source test logs private and makes
the public Docker image untested by a GitHub-hosted runner. A single
four-core hosted runner also cannot provide useful throughput for the
thousands of generated Slang and Verilator tests.

# Solution

- Add a GitHub-hosted public matrix that builds the checked-out public
Dockerfile and runs only explicit public-tool targets: one
Python/Stardoc runner, four deterministic Slang shards, and eight
deterministic Verilator shards.
- Partition labels with stable SHA-256 hashing, invoke Bazel once per
shard through `--target_pattern_file`, and validate complete,
non-overlapping coverage in the stable `bazel-oss-tool-test` aggregate
check.
- Restore trusted Docker and Bazel caches in every shard, use stable
per-shard Bazel disk-cache namespaces, disable PR cache saves, and allow
only one trusted shard to export the shared Docker cache.
- Add `bazel-build-and-proprietary-tool-test` on the self-hosted runner.
It runs `bazel build //...` plus Verific, AscentLint, and VCS with
summary-only test output.
- Retarget suite badges to their owning aggregate/private jobs, gate
public Docker image publication on the OSS aggregate succeeding, and
update README CI documentation.

# Validation

- `python3.12 -m unittest python.ci.bazel_oss_sharding_test -v`
- `actionlint .github/workflows/ci.yml`
- Targeted pre-commit hooks for YAML, Black, Buildifier, Gitleaks, and
repository policy checks
- Extracted container-shell `bash -n` validation and `git diff --check`

Repository-wide `pre-commit run --all-files` passes every hook except
`end-of-file-fixer`, which cannot write the checkout's read-only bundled
`.codex/skills` files.

---------

Co-authored-by: Codex <noreply@openai.com>

Author: mgottscho