feat: broaden CPU and platform coverage across PyPI, nodes, and crate… (#26)

* feat: broaden CPU and platform coverage across PyPI, nodes, and crates.io

Replace static SIMD with runtime CPU-feature dispatch and expand the release
wheel matrix so one set of artifacts runs on any target CPU and platform
without illegal-instruction crashes.

Rust core:
- Add multiversion runtime dispatch (crates/ferro_ta_core/src/simd.rs); drop
  compile-time `wide`. `simd` feature is now default-on and forwarded through
  the pyo3 crate, and stays compatible with #![forbid(unsafe_code)].

Packaging:
- abi3-py310: one cp310-abi3 wheel per platform (covers CPython 3.10+).
- CI matrix adds Linux aarch64 + musllinux (x86_64/aarch64) and Windows arm64.

Node/Docker + docs:
- api/Dockerfile: document baseline+dispatch (no target-cpu pin) and add a
  fail-fast import check; aarch64 containers now install cleanly.
- Rewrite docs/guides/simd.md; fix stale `wide` mention in ADR 0003.
- Add ADR 0006 (CPU coverage strategy).

Also bundles in-flight release prep already staged in the tree (DTW exception
types, SBOM/provenance security, supporting docs).

* fix(ci): clear cargo-deny and pip-audit failures; apply dependency bumps

cargo-deny (advisories):
- Ignore pyo3 RUSTSEC-2026-0176 / RUSTSEC-2026-0177 in deny.toml with a
  documented rationale: ferro-ta uses neither affected code path
  (PyList/PyTuple nth iterators; PyCFunction::new_closure). Upstream fix
  needs pyo3 >=0.29 (large API migration), tracked as a follow-up.

pip-audit:
- Bump dev lockfile idna 3.18, pytest 9.1.1, urllib3 2.7.0 to clear
  PYSEC-2026-215, CVE-2025-71176, PYSEC-2026-141/142.

Dependency bumps (supersede open dependabot PRs; they auto-close on merge):
- cargo: log 0.4.32, serde_json 1.0.150, rayon 1.12.0
- api/requirements.txt: uvicorn>=0.49.0, pydantic>=2.13.4, ferro-ta>=1.1.4
- CI actions: deploy-pages v5, upload-pages-artifact v5, action-gh-release v3

The open `wide` 1.5.0 bump (PR #24) is obsolete — the crate is removed in
this branch.

* chore: address CodeRabbit review; remove docs/adr section

CodeRabbit findings:
- CI sbom job: add `attestations: write` so attest-build-provenance can run
  (it had only contents:write + id-token:write).
- simd.rs: vectorize `wma_seed` with lane-local accumulators — it was scalar
  behind the multiversion wrapper, adding dispatch overhead for no SIMD gain.
- CHANGELOG: consolidate the duplicate `### Changed` heading.
- python/ferro_ta/__init__.py: also re-export the `FerroTaError` alias.
- docs/guides/dtw.md: soften "byte-for-byte" parity to within-tolerance.

Remove docs/adr/ at maintainer request and clean up the ADR links in the
SIMD and DTW guides. The ADR files remain in commit 9506a30 if ever needed.

crates/ferro_ta_core/src/overlap.rs

@@ -38,27 +38,10 @@ pub fn sma_into(src: &[f64], timeperiod: usize, dest: &mut [f64], dest_offset: u
         return;
     }
 
-    #[cfg(feature = "simd")]
-    let window_sum_init = {
-        use wide::f64x4;
-        let p_data = &src[..timeperiod];
-        let mut sum = f64x4::splat(0.0);
-        let mut chunks = p_data.chunks_exact(4);
-        for chunk in &mut chunks {
-            sum += f64x4::new([chunk[0], chunk[1], chunk[2], chunk[3]]);
-        }
-        let arr = sum.to_array();
-        let mut total = arr[0] + arr[1] + arr[2] + arr[3];
-        for &v in chunks.remainder() {
-            total += v;
-        }
-        total
-    };
-
-    #[cfg(not(feature = "simd"))]
-    let window_sum_init: f64 = src[..timeperiod].iter().sum();
-
-    let mut window_sum = window_sum_init;
+    // Seed the rolling window with a runtime-dispatched reduction. The O(n)
+    // streaming recurrence below is inherently sequential, so SIMD only ever
+    // applies to this initial window sum.
+    let mut window_sum = crate::simd::sum(&src[..timeperiod]);
     let tp_f64 = timeperiod as f64;
     dest[dest_offset + timeperiod - 1] = window_sum / tp_f64;
 
@@ -124,46 +107,9 @@ pub fn wma(close: &[f64], timeperiod: usize) -> Vec<f64> {
     let denom: f64 = (timeperiod * (timeperiod + 1) / 2) as f64;
     let p = timeperiod as f64;
 
-    // Seed: compute T and S for the first window.
-    #[cfg(feature = "simd")]
-    let (mut t, mut s) = {
-        use wide::f64x4;
-        let p_data = &close[..timeperiod];
-        let mut t_simd = f64x4::splat(0.0);
-        let mut s_simd = f64x4::splat(0.0);
-        let mut chunks = p_data.chunks_exact(4);
-        let mut idx = 1.0;
-        let step = f64x4::new([0.0, 1.0, 2.0, 3.0]);
-
-        for chunk in &mut chunks {
-            let vals = f64x4::new([chunk[0], chunk[1], chunk[2], chunk[3]]);
-            let mults = f64x4::splat(idx) + step;
-            t_simd += vals * mults;
-            s_simd += vals;
-            idx += 4.0;
-        }
-        let t_arr = t_simd.to_array();
-        let s_arr = s_simd.to_array();
-        let mut t = t_arr[0] + t_arr[1] + t_arr[2] + t_arr[3];
-        let mut s = s_arr[0] + s_arr[1] + s_arr[2] + s_arr[3];
-        for &v in chunks.remainder() {
-            t += v * idx;
-            s += v;
-            idx += 1.0;
-        }
-        (t, s)
-    };
-
-    #[cfg(not(feature = "simd"))]
-    let (mut t, mut s) = {
-        let t_val: f64 = close[..timeperiod]
-            .iter()
-            .enumerate()
-            .map(|(k, &v)| v * (k + 1) as f64)
-            .sum();
-        let s_val: f64 = close[..timeperiod].iter().sum();
-        (t_val, s_val)
-    };
+    // Seed: compute T and S for the first window via a runtime-dispatched
+    // reduction (the streaming recurrence below is sequential).
+    let (mut t, mut s) = crate::simd::wma_seed(&close[..timeperiod]);
 
     result[timeperiod - 1] = t / denom;