ci: run snip verify so the filters' inline tests are enforced

[edouard-claude]

Found while reviewing the #136 fixes.

The 132 bundled filters carry inline tests: blocks and 21 of them use it. Nothing runs them. ci.yaml has go test -race -cover, go vet, golangci-lint and govulncheck, and go test does not read filter YAML. A contributor could break any filter's own fixtures and CI would stay green.

That is not hypothetical here. #117, #121, #132, #135 and #136 each added or changed inline tests precisely so snip verify would guard the behaviour being fixed:

• filters/tsc.yaml — the two tests updated in fix(filters): drop compact_path from all 28 bundled filters #117, the only automated guard that compact_path does not come back
• filters/git-diff.yaml, git-log.yaml, git-show.yaml — added in fix(filters): stop git filters answering a different question than the one asked #132 to pin that snip invents no file count and that the diffstat substitution is labelled
• filters/rails-routes.yaml — added in fix(filters): keep the route table in rails-routes #135, and the only place that pins the fix, since the Go integration fixture is larger than the head cap and passes either way

All of those were unenforced.

The change

One step in the test job. The binary is built first because verify runs the embedded filter set rather than the files on disk, so an edit under filters/ is only visible after a rebuild.

      - name: Verify filters
        run: |
          go build -o /tmp/snip ./cmd/snip
          /tmp/snip verify

Confirmed it can actually fail

Breaking one expected: block in filters/git-diff.yaml and rebuilding:

git-diff ............ FAIL (2/3 passed)
132 filters, 20 tested, 45 tests, 44 passed, 1 failed
$ echo $?
1

Restored, and snip verify is back to 45/45 with exit 0. Runtime is under a second, so it costs nothing in the pipeline.