ci: add test gate to release workflow

[don-petry]

Why?

The release workflow builds and publishes binaries without running any tests first. A broken commit that happens to have a tag could ship corrupted binaries to users. Adding a test gate ensures every release passes formatting, linting, and tests before artifacts are built.

Summary

• Adds a test job to the release workflow that runs cargo fmt --all --check, cargo clippy --locked --all-targets -- -D warnings, and cargo test --locked
• The test job runs after verify_tag_on_main and must pass before the build matrix starts
• Ensures tagged releases are never published from code that fails basic quality checks

Refs #11 (item 2)

Test plan

• Push a tag to verify the new test job executes before build
• Confirm build is skipped if test fails

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a Rust quality gate to the tag-based release workflow so releases only build/publish after basic checks (formatting, clippy, and tests) pass on the tagged commit.

Changes:

• Add a new test job to release.yml that runs cargo fmt, cargo clippy -D warnings, and cargo test.
• Make the build job depend on the new test job (and still on verify_tag_on_main) so the build matrix won’t start unless tests pass.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: 418894a3bc23e23c3ce4cbb06d1040f3c4560a7c
Cascade: triage(haiku) → sonnet

Summary

PR adds a test gate (fmt, clippy, cargo test) to the release workflow before the build matrix runs, and fixes all clippy lints that the new stricter CI exposes. CI is fully green (Verify + Security Audit both pass), no secrets or auth changes are present, and all mechanical Rust fixes are correct. One minor note: tests run with --release flag which skips debug assertions, but this is not a blocking concern.

Findings

All findings are informational only — no blockers.

• [info] .github/workflows/release.yml — GitHub Actions steps use floating version tags (e.g. actions/checkout@v5, dtolnay/rust-toolchain@stable) rather than pinned SHA hashes. This is consistent with the existing repo style but is a mild supply-chain risk.
• [info] .github/workflows/release.yml — The test job runs cargo test --locked --release. Release mode disables debug_assert! macros, so some correctness checks may be skipped. Consider running without --release (or in addition to it) for the gate.
• [info] src/core/clean/apply.rs:296 — #[allow(clippy::too_many_arguments)] added to two functions. These suppress legitimate design warnings; acceptable for now but worth tracking as refactor candidates.
• [info] src/core/store/types.rs:351 — #[allow(clippy::enum_variant_names)] added to DaggerEvent. All event variants share a noun-prefix convention (Branch*); suppression is reasonable here.
• [info] src/core/sync.rs:130 — RemotePushActionKind enum variants renamed from verbose (CreateRemoteBranch, UpdateRemoteBranch, ForceUpdateRemoteBranch) to concise (Create, Update, ForceUpdate). Rename is consistent across all call sites.

CI status

All CI checks pass (Verify + Security Audit green).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 → audit: opus 4.6). Reply with @don-petry if you need a human.