ci(rust): add build/test/clippy gate; make the crates clippy-clean

The only Rust CI was CodeQL in build-mode `none` (buildless), so nothing
ever compiled or tested robot-repo-automaton / shared-context / dashboard
— which is how the non-compiling content-match path reached `main` before
it was fixed in the prior PR. Add `.github/workflows/rust.yml`: a per-crate
matrix running `cargo build --all-targets`, `cargo test`, and
`cargo clippy --all-targets -- -D warnings` (blocking), with
`cargo fmt --check` informational (there is pre-existing formatting drift —
~180 hunks — that is intentionally not gated yet).

To make the clippy gate pass, fix the existing findings:
- fixer.rs: drop a no-op `.replace("hyperpolymath", "hyperpolymath")`.
- registry_guard.rs: use `split_once('/')` instead of a manual `splitn(2)`.
- exclusion_registry.rs: rename the inherent `from_str` -> `parse` (it is
  not a `FromStr` impl; matches `Catalog::parse`) and use `if let Ok(..)`
  instead of `.ok()` + `if let Some(..)`.
- hypatia.rs / main.rs: accept `&Path` instead of `&PathBuf`.
- Cargo.toml (robot-repo-automaton + shared-context): drop the ignored
  `+spec-1.1.0` build metadata from the `toml` version requirement
  (resolution-neutral; silences the cargo warning).
- benches: import `std::hint::black_box` (criterion's re-export is deprecated).

All three crates are clippy `-D warnings` clean; 101 + 84 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RozeeLxpJsd3WWFngaZWz3

Author: claude

.github/workflows/rust.yml

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Rust
+# Build + test + clippy gate for the three standalone Rust crates.
+# Added after a non-compiling crate (robot-repo-automaton) reached `main`
+# unnoticed: the only prior Rust CI was CodeQL in build-mode `none`
+# (buildless), so nothing actually compiled or tested these crates.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['**']
+permissions:
+  contents: read
+env:
+  CARGO_TERM_COLOR: always
+  # reqwest=rustls-tls, git2=vendored-openssl, gix=rust-tls. OPENSSL_NO_VENDOR
+  # makes openssl-sys link the runner's preinstalled system OpenSSL instead of
+  # recompiling the vendored copy (matches the documented local build).
+  OPENSSL_NO_VENDOR: '1'
+jobs:
+  rust:
+    name: build · test · clippy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        crate: [robot-repo-automaton, shared-context, dashboard]
+    defaults:
+      run:
+        working-directory: ${{ matrix.crate }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Ensure clippy + rustfmt components
+        run: rustup component add clippy rustfmt
+      - name: Build (all targets)
+        run: cargo build --all-targets --verbose
+      - name: Test
+        run: cargo test --verbose
+      - name: Clippy (deny warnings)
+        run: cargo clippy --all-targets -- -D warnings
+      - name: Rustfmt check (informational)
+        # Pre-existing formatting drift is not yet gated; surfaced here so it
+        # stays visible without blocking. Flip to a hard gate after a dedicated
+        # `cargo fmt` pass lands.
+        run: cargo fmt --check
+        continue-on-error: true

robot-repo-automaton/Cargo.toml

@@ -42,7 +42,7 @@ reqwest = { version = "0.12.28", features = ["json", "rustls-tls"], default-feat
 # Serialization
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
-toml = "1.1.2+spec-1.1.0"
+toml = "1.1.2"
 
 # Git operations
 # Using vendored-openssl to avoid system OpenSSL dependency (libssl-dev)

robot-repo-automaton/src/exclusion_registry.rs

@@ -135,11 +135,11 @@ impl ExclusionRegistry {
                 e
             ))
         })?;
-        Self::from_str(&source)
+        Self::parse(&source)
     }
 
     /// Parse from an in-memory A2ML string.
-    pub fn from_str(source: &str) -> Result<Self> {
+    pub fn parse(source: &str) -> Result<Self> {
         let raw: RawRegistry = toml::from_str(source).map_err(|e| {
             crate::error::Error::Config(format!("failed to parse exclusion registry: {e}"))
         })?;
@@ -270,7 +270,7 @@ impl ExclusionRegistry {
         }
 
         // Kill-switch check first — cheapest, catches everything.
-        if let Some(kill) = env::var("HYPATIA_AUTOMATION").ok() {
+        if let Ok(kill) = env::var("HYPATIA_AUTOMATION") {
             let k = kill.to_ascii_lowercase();
             if matches!(k.as_str(), "off" | "disabled" | "0" | "false" | "halt") {
                 return Decision::Deny {
@@ -445,7 +445,7 @@ reason = "upstream homebrew"
 "#;
 
     fn registry() -> ExclusionRegistry {
-        ExclusionRegistry::from_str(FIXTURE).unwrap()
+        ExclusionRegistry::parse(FIXTURE).unwrap()
     }
 
     #[test]

robot-repo-automaton/src/fixer.rs

@@ -618,7 +618,6 @@ impl Fixer {
 
         content
             .replace("gitbot-fleet", repo_name)
-            .replace("hyperpolymath", "hyperpolymath")
             .replace("{{LICENSE}}", "MPL-2.0")
             .replace("{{YEAR}}", &year)
             .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")

robot-repo-automaton/src/hypatia.rs

@@ -562,7 +562,7 @@ impl CicdHyperAClient {
     /// - Auto-approve rules that consistently produce successful fixes
     pub async fn report_results(
         &self,
-        repo_path: &PathBuf,
+        repo_path: &Path,
         results: &[RuleExecutionResult],
     ) -> crate::Result<()> {
         if !self.config.enable_feedback {

robot-repo-automaton/src/main.rs

@@ -20,7 +20,7 @@ use clap::{Parser, Subcommand};
 use robot_repo_automaton::prelude::*;
 use robot_repo_automaton::github::{GitHubClient, CreatePullRequest};
 use robot_repo_automaton::confidence::ThresholdConfig;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use tracing::{debug, error, info, warn};
 use tracing_subscriber::EnvFilter;
 
@@ -712,7 +712,7 @@ async fn cmd_hooks(_config: Option<&Config>, action: HookAction) -> anyhow::Resu
 }
 
 /// Inspect the error catalog.
-fn cmd_catalog(path: &PathBuf, severity_filter: Option<&str>) -> anyhow::Result<()> {
+fn cmd_catalog(path: &Path, severity_filter: Option<&str>) -> anyhow::Result<()> {
     let catalog = ErrorCatalog::from_file(path)?;
     println!(
         "Error Catalog: {} error types (v{})",

robot-repo-automaton/src/registry_guard.rs

@@ -152,9 +152,7 @@ fn parse_full_name(url: &str) -> Option<String> {
     for prefix in ["https://", "http://", "ssh://", "git://"] {
         if let Some(rest) = s.strip_prefix(prefix) {
             // Skip the host segment.
-            let mut parts = rest.splitn(2, '/');
-            let _host = parts.next()?;
-            let path = parts.next()?;
+            let (_host, path) = rest.split_once('/')?;
             return Some(path.to_string());
         }
     }

shared-context/Cargo.toml

@@ -35,7 +35,7 @@ tokio = { version = "1.52.3", features = ["sync", "fs"] }
 notify = "8.2.0"
 
 # Bot exclusion registry (exclusion_registry + registry_guard modules)
-toml = "1.1.2+spec-1.1.0"
+toml = "1.1.2"
 glob = "0.3.3"
 git2 = { version = "0.21.0", default-features = false }
 

shared-context/benches/fleet_benchmarks.rs

@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: MPL-2.0
 //! Performance benchmarks for gitbot-fleet operations
 
-use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use gitbot_shared_context::{BotId, Context, Finding, Severity};
+use std::hint::black_box;
 use std::path::PathBuf;
 
 /// Benchmark context creation