CI: execute the AVX-512 kernels — designated runner or Intel SDE leg

Context

PR #277 added two AVX-512 kernels (wht_block_avx512 and permute_gather_avx512 in turbovec/src/rotation.rs). They are selected at runtime via is_x86_feature_detected!, and GitHub-hosted x86 runners don't guarantee AVX-512 (the fleet mixes AMD EPYC and older Intel parts). So CI compile-checks these kernels on every x86 leg but does not reliably execute them — the identity tests silently skip paths the host can't run. To date they have only provably executed on one machine (the Cascade Lake box the PR was developed on).

The rest of the SIMD surface is covered: the CI matrix runs x86 + arm64 across Linux/macOS/Windows, and the Rust legs set TURBOVEC_REQUIRE_SIMD=avx2, so AVX2, NEON, and scalar paths are all executed and enforced. This issue is only about the AVX-512 tier.

What #277 already provides

• TURBOVEC_REQUIRE_SIMD — an opt-in gate that turns a missing CPU feature into a test failure instead of a silent skip. Setting TURBOVEC_REQUIRE_SIMD=avx2,avx512f makes AVX-512 coverage measurable; it just isn't pointed at hardware that has the feature yet.
• Bit-exact identity tests against the scalar reference (wht_simd_matches_scalar_bit_exactly, permute_gather_paths_match_scalar_bit_exactly), injection-verified to actually fail when a kernel is wrong.

Requiring avx512f on the hosted runners was deliberately not done (see the comment at .github/workflows/ci.yml:38-41) because it would fail any honest run that lands on a non-AVX-512 machine.

Options

1. Designated runner known to have AVX-512 (self-hosted or a larger hosted runner with a guaranteed CPU), running the test suite with TURBOVEC_REQUIRE_SIMD=avx2,avx512f.
2. Intel SDE leg — Intel's Software Development Emulator can execute AVX-512 instructions on any x86 host, e.g. sde64 -spr -- cargo test -p turbovec --release with the same env var. Slower, but runs on standard hosted runners.

Either closes the gap; SDE is the cheaper starting point since it needs no infrastructure.

Cheap interim step (optional)

Have the Rust CI legs print the detected feature set, so each run records which kernels actually executed instead of leaving it to inference.

Acceptance

• At least one CI leg executes both AVX-512 kernels with TURBOVEC_REQUIRE_SIMD=avx2,avx512f set, so a skip is a failure.
• The "single-machine-verified" caveat from the #277 merge notes can be retired.

Follow-up from #277 (review thread). Related follow-ups: #279 (official x86 benchmark rerun), #280 (persist benchmark results).