Stabilize Coverity Scan triage and document known false positives

[antonwolfy]

Summary

Backport of IntelPython/mkl_umath#266, adapted to mkl_fft. Stabilizes Coverity Scan triage and documents the verified false positives.

Two changes:

1. Pin Cython in the Coverity workflow
cython==3.3.0 in .github/workflows/coverity.yml only (not pyproject.toml, so shipped wheels are unaffected). A Cython version bump regenerates _pydfti.c wholesale, which churns Coverity CIDs and silently drops their triage; pinning keeps the generated code byte-stable between scans. Works because the scan build runs with --no-build-isolation.

2. Add coverity/README.md
A triage guide covering:

• Where findings come from across mkl_fft's two captured translation units — template-generated mklfft.c (our oneMKL DFTI logic, kept in scope) and Cython-generated _pydfti.c.
• The Cython-pin rationale and an opt-in Project Component to group (not ignore) the Cython unit.
• A review checklist keeping mklfft.c, the mkl_fft/src/*.h helpers, and the __pyx_pf_* bodies in scope.
• The verified false-positive families, matched on checker + mechanism (not CID, since CIDs reset on a Cython bump).

Documented false-positive families

All triaged Intentional / Ignore / Minor.

Cython-generated boilerplate (_pydfti.c):

• DEADCODE — tp_traverse base-traversal preamble (__Pyx_Coroutine_traverse, __Pyx_CyFunction_traverse, _genexpr and _get_element_strides scope traversals) — one mechanism.
• DEADCODE — version/ABI-guarded helpers (__Pyx_VectorcallBuilder_AddArg, __Pyx_PyCode_New, __Pyx_ParseKeywordDict).
• UNUSED_VALUE — Cython reference-cleanup epilogue in _c2r_fft1d_impl.
• CHECKED_RETURN — __Pyx_Generator_Replace_StopIteration.

Our .pyx, dead-by-construction (__pyx_pf_*):

• DEADCODE — redundant is NULL guards in _process_arguments / _direct_fftnd that Cython's own post-call error check already makes unreachable.
• DEADCODE — the _c2r_fft1d_impl in-place stub (in_place = 0 right before if in_place:), an intentional placeholder.

Adaptation from mkl_umath

mkl_fft's translation units differ from mkl_umath's, so the table was rebuilt from mkl_fft's own scan and generated code, not copied. mkl_umath's documented families (the __umath_generated.c InitOperators DEADCODE, the with-statement DEADCODE, the __Pyx__Import DEADCODE — which is inverted here because mkl_fft's module name mkl_fft._pydfti contains a dot — and the _patch_impl FORWARD_NULL) do not occur in mkl_fft and were deliberately omitted.