Add a randomized upper bound on code distance reusing the DEM sampler core

[ciaranra]

Why

PECOS has a randomized upper bound on circuit (DEM) fault distance, but none at code level — the regime that reaches codes too large for the exact engines (the [[975,195,24]] class and beyond). This adds it, and it is the same algorithm: for a sampled nonempty logical subset S, BP-OSD-decode the augmented system [H; l_S] e = [0; 1] (arXiv:1904.02703, with the randomized-subset idea of arXiv:2308.15140) and keep the lightest natively verified witness. Sound by construction — every candidate passes DistanceProblem::verify_witness before it can tighten the bound, so a heuristic decoder can only fail to help, never corrupt the answer.

What changed

The DEM sampler's core loop was already generic over an (H, L) pair; the DEM only served to build a DistanceProblem and supply the H-side entries. This PR:

• Factors that core into randomized_distance_upper_bound(...), and rebuilds randomized_fault_distance_upper_bound (the DEM entry point) on top of it with no behaviour change — proven by the existing DEM tests passing unchanged.
• Adds randomized_code_distance_upper_bound(h, l, config) (binary (H, L) via ParityCheckMatrix) and randomized_stabilizer_code_distance_upper_bound(spec, config) (symplectic, qubit-support weight). The stabilizer variant calls verify_as_complete_code() first — inheriting the completeness discipline the Distance finding and fault-tolerance tooling: Rust engine, typed inputs, DEM fault distance, docs #415 review established — so an ill-formed spec is rejected rather than silently bounded.
• Python binding for the matrix variant on pecos.qec, returning the shipped FaultDistanceUpperBoundResult (its bound_kind stays UpperBound). Docs never call the result a distance.

Measurement

Gross [[144,12,12]] bivariate-bicycle code, via the matrix binding on (Hx, Lx):

Samples	Bound	Time
12	12	0.1 s
48	12	0.3 s
96	12	0.6 s

It reaches the published distance (12) in a tenth of a second and is seed-deterministic. The exact check-driven search certifies the same code's distance in ~22 s; this matches it as a bound roughly 200x faster, and unlike the exact engine it keeps working where they become infeasible.

Verification

• cargo test -p pecos-qec (full), including the unchanged DEM upper-bound tests (behaviour-preservation proof) and new code-level tests: soundness on the repetition, Steane, and five-qubit codes (bound >= exact, and tight), determinism, and rejection of a no-logicals spec.
• cargo clippy --locked -p pecos-qec -p pecos-rslib --all-targets -- -D warnings, cargo fmt --all --check, pre-commit run --all-files, and cargo test -p pecos --features neo (guard) all clean.
• New Python test file passes; the binding was exercised end-to-end for the measurement above.