ci(rust): add build/test/clippy gate; make crates clippy-clean (#300)

Items #2 (clippy sweep) and #1 (close the CI gap) from the follow-up
list, as one PR — the lint fixes and the gate that enforces them belong
together so CI is self-consistent.

## Why
The only Rust CI was CodeQL in build-mode `none` (**buildless**) —
nothing compiled or tested `robot-repo-automaton` / `shared-context` /
`dashboard`. That's exactly how the non-compiling content-match path
reached `main` before #299 fixed it. This closes that gap.

## The gate — `.github/workflows/rust.yml`
Per-crate matrix (modeled on `e2e.yml`: SHA-pinned checkout,
`permissions: contents: read`, SPDX header):
- `cargo build --all-targets`
- `cargo test`
- `cargo clippy --all-targets -- -D warnings` *(blocking)*
- `cargo fmt --check` *(informational, `continue-on-error`)* — there's
~180 hunks of **pre-existing** formatting drift; gating it would mean a
giant reformat that buries this change, so it's surfaced but not yet
enforced. A dedicated `cargo fmt` pass can flip it to blocking later.

## Clippy fixes (to make the gate green)
| File | Finding | Fix |
|---|---|---|
| `fixer.rs` | `.replace("hyperpolymath", "hyperpolymath")` | no-op —
removed |
| `registry_guard.rs` | manual `splitn(2, '/')` | `split_once('/')` |
| `exclusion_registry.rs` | `from_str` shadows `FromStr` | rename
inherent `from_str` → `parse` (matches `Catalog::parse`; 2 internal call
sites) |
| `exclusion_registry.rs` | `.ok()` + `if let Some` | `if let Ok(..)` |
| `hypatia.rs`, `main.rs` | `&PathBuf` arg | `&Path` |
| `Cargo.toml` ×2 | `toml = "1.1.2+spec-1.1.0"` | drop ignored `+spec`
build-metadata (resolution-neutral; silences cargo warning) |
| `benches/fleet_benchmarks.rs` | deprecated `criterion::black_box` |
import `std::hint::black_box` (one import swap covers all call sites) |

## Verification
All three crates: **clippy `-D warnings` clean**, build clean. Tests:
**101** (robot-repo-automaton) + **84** (shared-context) pass. Locally
simulated the full matrix (build + test + clippy) green per crate;
`rust.yml` parses as valid YAML.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01RozeeLxpJsd3WWFngaZWz3

---
_Generated by [Claude
Code](https://claude.ai/code/session_01RozeeLxpJsd3WWFngaZWz3)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/rust.yml

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Rust
+# Build + test + clippy gate for the three standalone Rust crates.
+# Added after a non-compiling crate (robot-repo-automaton) reached `main`
+# unnoticed: the only prior Rust CI was CodeQL in build-mode `none`
+# (buildless), so nothing actually compiled or tested these crates.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['**']
+permissions:
+  contents: read
+env:
+  CARGO_TERM_COLOR: always
+  # reqwest=rustls-tls, git2=vendored-openssl, gix=rust-tls. OPENSSL_NO_VENDOR
+  # makes openssl-sys link the runner's preinstalled system OpenSSL instead of
+  # recompiling the vendored copy (matches the documented local build).
+  OPENSSL_NO_VENDOR: '1'
+jobs:
+  rust:
+    name: build · test · clippy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        crate: [robot-repo-automaton, shared-context, dashboard]
+    defaults:
+      run:
+        working-directory: ${{ matrix.crate }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Ensure clippy + rustfmt components
+        run: rustup component add clippy rustfmt
+      - name: Build (all targets)
+        run: cargo build --all-targets --verbose
+      - name: Test
+        run: cargo test --verbose
+      - name: Clippy (deny warnings)
+        run: cargo clippy --all-targets -- -D warnings
+      - name: Rustfmt check (informational)
+        # Pre-existing formatting drift is not yet gated; surfaced here so it
+        # stays visible without blocking. Flip to a hard gate after a dedicated
+        # `cargo fmt` pass lands.
+        run: cargo fmt --check
+        continue-on-error: true

robot-repo-automaton/Cargo.toml

@@ -42,7 +42,7 @@ reqwest = { version = "0.12.28", features = ["json", "rustls-tls"], default-feat
 # Serialization
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
-toml = "1.1.2+spec-1.1.0"
+toml = "1.1.2"
 
 # Git operations
 # Using vendored-openssl to avoid system OpenSSL dependency (libssl-dev)

robot-repo-automaton/src/exclusion_registry.rs

@@ -135,11 +135,11 @@ impl ExclusionRegistry {
                 e
             ))
         })?;
-        Self::from_str(&source)
+        Self::parse(&source)
     }
 
     /// Parse from an in-memory A2ML string.
-    pub fn from_str(source: &str) -> Result<Self> {
+    pub fn parse(source: &str) -> Result<Self> {
         let raw: RawRegistry = toml::from_str(source).map_err(|e| {
             crate::error::Error::Config(format!("failed to parse exclusion registry: {e}"))
         })?;
@@ -270,7 +270,7 @@ impl ExclusionRegistry {
         }
 
         // Kill-switch check first — cheapest, catches everything.
-        if let Some(kill) = env::var("HYPATIA_AUTOMATION").ok() {
+        if let Ok(kill) = env::var("HYPATIA_AUTOMATION") {
             let k = kill.to_ascii_lowercase();
             if matches!(k.as_str(), "off" | "disabled" | "0" | "false" | "halt") {
                 return Decision::Deny {
@@ -445,7 +445,7 @@ reason = "upstream homebrew"
 "#;
 
     fn registry() -> ExclusionRegistry {
-        ExclusionRegistry::from_str(FIXTURE).unwrap()
+        ExclusionRegistry::parse(FIXTURE).unwrap()
     }
 
     #[test]

robot-repo-automaton/src/fixer.rs

@@ -618,7 +618,6 @@ impl Fixer {
 
         content
             .replace("gitbot-fleet", repo_name)
-            .replace("hyperpolymath", "hyperpolymath")
             .replace("{{LICENSE}}", "MPL-2.0")
             .replace("{{YEAR}}", &year)
             .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")

robot-repo-automaton/src/hypatia.rs

@@ -562,7 +562,7 @@ impl CicdHyperAClient {
     /// - Auto-approve rules that consistently produce successful fixes
     pub async fn report_results(
         &self,
-        repo_path: &PathBuf,
+        repo_path: &Path,
         results: &[RuleExecutionResult],
     ) -> crate::Result<()> {
         if !self.config.enable_feedback {

robot-repo-automaton/src/main.rs

@@ -20,7 +20,7 @@ use clap::{Parser, Subcommand};
 use robot_repo_automaton::prelude::*;
 use robot_repo_automaton::github::{GitHubClient, CreatePullRequest};
 use robot_repo_automaton::confidence::ThresholdConfig;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use tracing::{debug, error, info, warn};
 use tracing_subscriber::EnvFilter;
 
@@ -712,7 +712,7 @@ async fn cmd_hooks(_config: Option<&Config>, action: HookAction) -> anyhow::Resu
 }
 
 /// Inspect the error catalog.
-fn cmd_catalog(path: &PathBuf, severity_filter: Option<&str>) -> anyhow::Result<()> {
+fn cmd_catalog(path: &Path, severity_filter: Option<&str>) -> anyhow::Result<()> {
     let catalog = ErrorCatalog::from_file(path)?;
     println!(
         "Error Catalog: {} error types (v{})",

robot-repo-automaton/src/registry_guard.rs

@@ -152,9 +152,7 @@ fn parse_full_name(url: &str) -> Option<String> {
     for prefix in ["https://", "http://", "ssh://", "git://"] {
         if let Some(rest) = s.strip_prefix(prefix) {
             // Skip the host segment.
-            let mut parts = rest.splitn(2, '/');
-            let _host = parts.next()?;
-            let path = parts.next()?;
+            let (_host, path) = rest.split_once('/')?;
             return Some(path.to_string());
         }
     }

shared-context/Cargo.toml

@@ -35,7 +35,7 @@ tokio = { version = "1.52.3", features = ["sync", "fs"] }
 notify = "8.2.0"
 
 # Bot exclusion registry (exclusion_registry + registry_guard modules)
-toml = "1.1.2+spec-1.1.0"
+toml = "1.1.2"
 glob = "0.3.3"
 git2 = { version = "0.21.0", default-features = false }
 

shared-context/benches/fleet_benchmarks.rs

@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: MPL-2.0
 //! Performance benchmarks for gitbot-fleet operations
 
-use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use gitbot_shared_context::{BotId, Context, Finding, Severity};
+use std::hint::black_box;
 use std::path::PathBuf;
 
 /// Benchmark context creation