Align repo orchestration with stake/token-2022 conventions

[lorisleiva]

This PR replaces the bespoke zx-based scripts and hand-written GitHub workflows with the converged solana-program/* conventions: a root Makefile for all repo tasks and thin wrappers around the reusable workflows in solana-program/actions. The JS client's newer stack (Oxlint / Oxfmt / Vitest / LiteSVM) is preserved as-is.

What changed

• Added root Makefile with pattern targets (format-check-%, clippy-%, build-sbf-%, test-%, test-js-%, lint-js-%, audit, spellcheck, generate-clients, publish-{js,rust}-%, …). The test-js-% recipe deliberately omits validator start/stop because the JS client runs in-process via LiteSVM.
• Replaced .github/workflows/main.yml with a thin wrapper around solana-program/actions/.github/workflows/main.yml@main.
• Replaced publish-js-client.yml and publish-rust-client.yml with wrappers around the reusable publish-js.yml / publish-rust.yml.
• Added scripts/cliff.toml for git-cliff changelog generation in publish workflows.
• Removed .github/actions/setup/ (now solana-program/actions/setup-ubuntu@main), all scripts/{js,rust,ci}/*.mjs orchestration scripts, and their helpers.
• Slimmed root package.json to only Codama + TypeScript; dropped zx and @iarna/toml from devDeps; regenerated pnpm-lock.yaml.
• Updated READMEs to reference the new make targets.

Behavioural changes

These all align with the conventions used in stake and token-2022:

• CI gains coverage: clients/rust now runs through format / clippy / test on every push; new build-doc-% (with RUSTDOCFLAGS="--cfg docsrs -D warnings") and powerset-% (cargo-hack feature powerset) gates run for every Rust package.
• Clippy flags: drops -Zunstable-options and --no-deps; same deny list (warnings, clippy::arithmetic_side_effects).
• Published npm packages will carry provenance attestations (NPM_CONFIG_PROVENANCE=true is baked into the reusable publish workflow).
• cargo semver-checks now runs on publish-rust against the previously published version. Since clients/rust is at 0.0.0 and never published, the first real publish may need run-semver: false (one-time).
• cargo release now passes --dependent-version fix (no-op for this repo — no cross-crate workspace deps).
• Publish commit/tag annotations change to "Publish js@vX.Y.Z" (tag names themselves — js@vX.Y.Z, rust@vX.Y.Z — are unchanged).
• GitHub releases now have a body generated from git-cliff instead of empty.
• Publish-JS auth switches from ANZA_TEAM_PAT + SOLANA_PROGRAM_NPM_TOKEN to a GitHub App (vars.APP_ID + secrets.PRIVATE_KEY); these need to be provisioned on the repo before the first publish under the new flow.
• CI cosmetics: the program-builds GitHub artifact is no longer uploaded for download (internal cache only); RUST_LOG=error is no longer set on program tests.
• DX removals: pnpm solana:check, pnpm solana:link, pnpm template:upgrade are gone with no replacement (developer convenience only — no CI impact).

Local verification

Ran make format-check-{program,clients-rust}, make clippy-clients-rust, make build-doc-{program,clients-rust}, make format-check-js-clients-js, make lint-js-clients-js, make generate-clients (no diff produced), and make test-js-clients-js (all 73 tests pass).