Verified Completions: split the repo into a Cargo workspace (engine + gateway) #82

Why

The Verified Completions gateway will be a separate crate that talks to the engine over the existing WebSocket API, like any other client. This keeps HTTP and LLM dependencies (axum, reqwest, retry logic) out of the engine crate and forces the gateway to use the public API. The repo is a single crate today, so we need a workspace first.

What to do

• Convert the root Cargo.toml to a Cargo workspace
• Keep the engine as the existing crate (path and crate name unchanged if possible, to avoid churn in imports and CI)
• Add an empty gateway/ member crate as a placeholder
• Make sure cargo build, cargo test, the Docker image, and CI all still work exactly as before
• No engine code changes in this PR. Mechanical restructuring only

Done when

CI is green, the Docker image behaves the same, and gateway/ exists as an empty workspace member ready for the M0 work.

Depends on

Nothing. Can run in parallel with the rule pack validation.