chore(tidy): make cert-err33-c a hard stop in .clang-tidy

[lusoris]

Summary

Closes T-CERT-ERR33-SWEEP: promotes cert-err33-c (an ignored return value of a standard-library call) to WarningsAsErrors in .clang-tidy, as ADR-0694 asked once the violations were swept.

• Measured, not assumed: full runs of every lane in the dev container (scripts/dev/tidy-lane.sh --jobs 4 <lane>, clang-tidy 22.1.8, master 1ec97c450): cpu 0 findings, sycl 0 (491 translation units), cuda 475 findings and none is cert-err33-c (504 TUs), hip 0 (505 TUs); the last arm64 report has none. The four sites of core/src/feature/adm.c the row named were fixed by the ADR-1142 cleanups.
• Check proven to fire: a planted fclose(f); exits 0 with cert-err33-c as a warning and 1 with --warnings-as-errors=cert-err33-c (host clang-tidy 23.1.1).
• docs/development/tidy-ratchet.md states the new hard stop; no baseline changes (all counts unchanged, so no --write).
• The Metal lane cannot run on this host; the rebase note of the Metal tidy batch records it at zero findings.

Reproducer

scripts/dev/tidy-lane.sh --jobs 4 sycl && python3 - <<'PY'
import json, os
d = json.load(open(os.path.expanduser('~/.cache/vmafx-tidy-lanes/tidy-ratchet-sycl.json')))
print(d['total_warnings'], json.dumps(d['diagnostics']).count('err33'))
PY

Deliverables (ADR-0108)

• Research digest — no digest needed: trivial.
• Decision matrix — no alternatives: only-one-way fix (ADR-0694 decided it).
• AGENTS.md invariant note — no rebase-sensitive invariants.
• Reproducer / smoke-test command — above.
• CHANGELOG fragment — changelog.d/changed/tidy-cert-err33-errors.md.
• Rebase note — no rebase impact: one line of .clang-tidy.
• Docs — docs/development/tidy-ratchet.md.
• State — row moved to Recently closed in docs/state.md.

tidy: cpu, cuda, hip, sycl lanes measured whole; no native file touched.