Add compile-time-checked ghost/observe layer

[carlsverre]

Adds an optional layer on top of the existing API for writing read-only test properties and ghost state, ported from antithesis-sdk-rust#34 and adapted to precept's enabled feature gate and expect_* macros.

observe! runs a property block that may call any precept API and may optionally borrow one or more GhostStates. Its Fn bound makes it easier to avoid unintentionally mutating the system under test — the borrow checker rejects &mut captures, reassignment, and moves inside the block. This is a best-effort guardrail rather than a hard guarantee: it can't stop interior mutability (Cell, RefCell, Mutex, atomics) or unsafe, and the module docs call that out explicitly.

GhostState<T> is opaque auxiliary state that exists only to express properties. Its only mutator is GhostState::mutate and its only reader is observe!, so it can't leak into or perturb the system it describes. When the enabled feature is off it becomes a zero-sized type and every access compiles out, while the read-only and type checks still happen in every build configuration.

Everything is implemented in safe Rust with a plain Fn bound — no unsafe, proc macros, or AST inspection. The layer is exercised by unit tests (gated behavior plus an always-on smoke test) and doctests, including compile_fail doctests that prove mutation attempts don't compile. Verified against the full CI matrix — build, tests, doctests, clippy, and fmt — with and without --all-features.