ci: add cargo clippy lint step

[don-petry]

Why?

Clippy catches common Rust mistakes, performance issues, and style violations that cargo check misses. Running it in CI prevents these from accumulating — a lint-clean codebase is easier to maintain and review.

Summary

• Add clippy component to the Rust toolchain installation
• Add a cargo clippy --locked --all-targets -- -D warnings step after cargo check in CI

Addresses item 1 in #11.

Test plan

• CI passes with the new clippy step
• Intentionally introduce a clippy warning and verify CI fails

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR strengthens the Rust CI quality gate by installing the Clippy component and running cargo clippy (with warnings treated as errors) as part of the existing verification workflow, aligning with Issue #11’s first item.

Changes:

• Install the Rust toolchain with both rustfmt and clippy components.
• Add a cargo clippy --locked --all-targets -- -D warnings step after cargo check in CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: 3e7dbd3234d8532d130b09333dc895e873021cee
Council vote: security=LOW · correctness=LOW · maintainability=LOW

Summary

All three council members approved this minimal CI enhancement. The PR correctly adds cargo clippy as a lint gate with -D warnings, installing the clippy component and inserting the step in logical order between cargo check and cargo test. The change is consistent with existing CI conventions, addresses item 1 of the now-closed issue #11, and introduces no security, correctness, or maintainability concerns. The only open question is confirming CI passes once checks run.

Linked issue analysis

Issue #11 ("CI & quality gate improvements") is already closed. The diff precisely matches the specification for item 1: the clippy component is added to the toolchain and cargo clippy --locked --all-targets -- -D warnings is inserted between cargo check and cargo test. No formal closing keyword is present because this covers only one item of a multi-item issue; no action needed since the issue is already closed.

Findings

All findings are informational only — no blockers.

[info] Security + Correctness + Maintainability — CI status unknown: statusCheckRollup is empty despite ci.yml triggering on pull_request events. mergeStateStatus is BLOCKED, likely pending this review approval. Confirm CI passes before merge completes (auto-merge enabled — will proceed once checks clear).

[info] Security — .github/workflows/ci.yml — Pre-existing (not introduced here): dtolnay/rust-toolchain@stable and Swatinem/rust-cache@v2 use mutable tags rather than pinned SHA digests. Worth addressing in a follow-up for supply-chain hardening.

[info] Correctness — Issue #11 is already CLOSED. Verify it was not closed as already-complete by another PR before this merges.

[info] Correctness — Both test-plan checkboxes are unchecked (CI passes with new clippy step; intentionally introduce a warning to verify CI fails). These are author verification steps; the diff itself is correct.

[info] Maintainability — AGENTS.md — The Verification Notes section lists cargo check and cargo test as the local verification baseline but does not mention cargo clippy. Now that clippy is enforced in CI, contributors following AGENTS.md may miss this gate. Consider adding cargo clippy --all-targets -- -D warnings to the checklist in a follow-up.

CI status

No CI check results reported (statusCheckRollup is empty). mergeStateStatus is BLOCKED, likely pending this review approval. Auto-merge has been enabled — the PR will merge automatically once all required checks pass.

---

Reviewed automatically by the don-petry PR-review council (security: opus 4.6 · correctness: sonnet 4.6 · maintainability: sonnet 4.6 · synthesis: sonnet 4.6). The marker on line 1 lets the agent detect new commits and re-review. Reply with @don-petry if you need a human.