Adopt the gha module: one gha:: recipe per gating CI job

[lann]

The sibling-family arrangement (websocket/webcrypto), adopted here: CI job bodies live in .github/justfile (the gha module), each gating workflow job runs exactly one just gha::<job> recipe with per-recipe log groups and failure annotations, and just ci mirrors the gating jobs. The actions-setup-smoke job is excluded by design: it dogfoods the actions/setup composite action and only exists as workflow machinery.

• gha::host-checks steps fmt-check, lint, test, wit-check; gha::verify steps all then emit-demo.
• The host-checks recipe becomes check — the family name for the fast pre-commit gate; the CI job keeps its name through gha::host-checks.
• The "Emit JUnit (demo)" workflow step folds into gha::verify, so just ci produces the same artifacts CI's presentation steps (actions/aggregate, the junit reporter) render; those steps are untouched.
• _default becomes a visible default; AGENTS.md's recipe list gains just check and just ci.

Verified: every gha::_step target dry-run-resolves; the _step wrapper exercised in local passthrough, GHA log-group, and failure-annotation modes; the workflow parses; just fmt-check passes; no stale just host-checks references remain. The substantive gate is this PR's CI, which runs exactly the recipes it always ran, now through the gha module.