feat!: Gaussian's EP operations stop wearing arithmetic's clothes

`Gaussian` publicly implemented `Mul`, `Div`, `Add` and `Sub`. They were
the EP product, cavity and variance-space convolutions, and every one of
them lies to a reader who takes the operator at face value:

    a = N(10, 2)   b = N(4, 3)   c = N(1, 1)

    a * b        N(8.15, 1.66)   not 40
    a - b        sigma GREW, 2 -> sqrt(4 + 9)
    a * N(1, 0)  mu = NaN        "multiply by one"
    a / c        pi = -0.75      mu() prints a confident 0

The last is this crate's signature defect on a public operator. `Div` is
the cavity and can legitimately leave a negative precision, which is not
a distribution — and `mu()`/`sigma()` guard `pi <= 0` and report `0.0`
and `inf`, so it comes back as a plausible number with no panic, no
`Debug` marker and nothing to test against.

The four impls are now `pub(crate)` inherent methods that say what they
do: `ep_product`, `cavity`, `convolve`, `convolve_diff`, plus `scale`
for the one operation that genuinely is arithmetic. Nothing in a user's
workflow needed operator syntax; inference did, and it still has it.

`pi()` and `tau()` follow. Storing natural parameters is a performance
decision — it makes message passing two adds — not a contract. The
public surface is now exactly: `from_ms`, `from_mv`, `mu`, `sigma`,
`variance`, `probability_below`, `probability_above`. `from_mv` and
`variance` are promoted from `pub(crate)`; they are the honest pair for
callers who already hold a variance and should not pay a round trip
through the square root.

Four integration tests asserted bit-identity on `(pi, tau)`. They assert
it on `(mu, variance)` instead — still `assert_eq!`, still exact, and
`1/pi` and `tau/pi` are deterministic, so bit-equal natural parameters
give bit-equal moments. `a_nan_sigma_passes_through_from_ms` drops its
`|| g.pi().is_nan()` half: `sigma()` substitutes for `pi <= 0` and
`pi == inf`, so NaN survives to it only from a NaN precision.

`benches/gaussian.rs` is deleted. It timed two f64 additions through the
public operators, and keeping those public solely to feed it is the same
thing #73 objected to when a benchmark was dictating five public types.
The paths it covered are exercised by `batch` and `history_converge`
through the real call chain.

Closes #71.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hcFjNDmHXZF8URGLku5zZ

tests/registration.rs

@@ -94,8 +94,8 @@ fn registering_matches_configuring_on_the_first_event() {
     };
 
     for ((k, a), (_, b)) in skills(&configured).into_iter().zip(skills(&registered)) {
-        assert_eq!(a.pi(), b.pi(), "{k} pi");
-        assert_eq!(a.tau(), b.tau(), "{k} tau");
+        assert_eq!(a.mu(), b.mu(), "{k} mu");
+        assert_eq!(a.variance(), b.variance(), "{k} variance");
     }
 }
 
@@ -225,8 +225,8 @@ fn registration_makes_the_fit_order_independent() {
     let forward = build(false);
     let backward = build(true);
     for ((k, a), (_, b)) in skills(&forward).into_iter().zip(skills(&backward)) {
-        assert_eq!(a.pi(), b.pi(), "{k} pi");
-        assert_eq!(a.tau(), b.tau(), "{k} tau");
+        assert_eq!(a.mu(), b.mu(), "{k} mu");
+        assert_eq!(a.variance(), b.variance(), "{k} variance");
     }
 }
 
@@ -246,8 +246,8 @@ fn rating_reads_back_what_was_stored() {
     .unwrap();
     let r = h.rating(&"layout").unwrap();
     assert_eq!(r.drift_scale(), 0.25);
-    assert_eq!(r.prior().pi(), PINNED.pi());
-    assert_eq!(r.prior().tau(), PINNED.tau());
+    assert_eq!(r.prior().mu(), PINNED.mu());
+    assert_eq!(r.prior().variance(), PINNED.variance());
 
     // A competitor created by an event reports the history defaults.
     h.record_winner(&"player", &"layout", 1).unwrap();