fix(rust-ci): make the newly-wired GitLab cargo jobs actually pass (#74)

Follow-up to #71, closing the gap I flagged there: the GitLab `cargo-*`
jobs were "reviewed by inspection, not runnable in the sandbox." I have
a working Rust toolchain here, so I actually ran all nine first-party
crates through `cargo build`/`test`/`fmt`. Result: **8 of 9 build clean
once fixed, 1 is a known-optional non-builder**. Three commits:

## 1. `fix(selur): add missing tokio AsyncReadExt import` (`02ff456`)
`services/selur` has **never compiled**. `sign_image` had a
function-local `use tokio::io::AsyncReadExt;`, but `generate_keypair` (a
second call site) also does `file.take(..).read_to_string(..)` without
the trait in scope — so `.take()` resolved to `Iterator::take` on
`tokio::fs::File` and failed (`E0599`/`E0282`). The dormant GitLab jobs
never caught it, and `nif-build.yml` doesn't cover `services/`. Hoisted
the import to module scope, dropped the redundant local one, removed
`mut` from two read-only bindings. `cargo build --release` + `cargo
test` pass.

## 2. `style(rust): cargo fmt all first-party crates` (`1d743b2`)
The `rustfmt` job (not `allow_failure`) runs `cargo fmt -- --check` per
crate; all 8 failed because the code was never fmt-checked while the job
was dormant — same story as the `mix format` sweep in #71, for Rust.
Pure `cargo fmt` output, no logic changes.

## 3. `fix(gitlab-ci): quarantine the non-building quic_transport NIF`
(`89a4c1b`)
`opsm_ex/native/quic_transport` does **not** compile: pinned `h3 0.0.6`
/ `h3-quinn 0.0.7` predate `quinn 0.11`'s now-private `StreamId` field,
and with no committed `Cargo.lock` the fresh resolve breaks. It's an
**optional** QUIC/HTTP3 NIF — `Opsm.Transport.QuicNif` swallows a failed
`:erlang.load_nif` and falls back to HTTP/2 (`nif_loaded?` is hard-coded
`false`), so the Elixir side (807 tests) runs fine without it, and no CI
builds it today. Rather than sink a full pre-1.0 `h3`-ecosystem
migration into optional aspirational code, I removed it from
`$RUST_CRATE_DIRS` and the `rules:`/artifacts lists, with a
`QUARANTINED` header note stating the un-quarantine condition (migrate
the `h3`/`h3-quinn`/`quinn` triple to a compatible set + commit a
lockfile). **Flagged as a follow-up decision for you** — see below.

## Verified (real Rust 1.9x toolchain, this environment)
- All 8 kept crates: `cargo build --release` ✓, `cargo fmt -- --check`
✓; `checky-monkey` tests 4/4, others build clean (0 tests defined)
- `.gitlab-ci.yml` parses; only 2 `quic_transport` mentions remain (both
the header note)
- `just toolchain-check` ✓

## For your call (not done here)
- **quic_transport migration**: the `h3` crate is pre-1.0 and churns
hard (`recv_data` now returns `impl Buf`, send-side API changes, etc.) —
a real migration, not a version bump. Worth doing only if QUIC/HTTP3
transport is on the near-term roadmap; otherwise the quarantine + HTTP/2
fallback is the honest steady state.
- The `cargo-audit`/`cargo-deny` job *bodies* still aren't exercised
here (installing those tools from crates.io for 8 crates wasn't worth
the sandbox time); the build/test/fmt jobs are now genuinely verified.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.gitlab-ci.yml

@@ -16,6 +16,16 @@
 # $RUST_CRATE_DIRS. Keep that variable and each job's `rules: exists:`
 # list in sync when a crate is added or removed — `rules: exists:` needs
 # literal paths, it does not expand CI variables.
+#
+# QUARANTINED: opsm_ex/native/quic_transport is deliberately absent from
+# $RUST_CRATE_DIRS. It is an OPTIONAL QUIC/HTTP3 NIF — Opsm.Transport.QuicNif
+# swallows a failed :erlang.load_nif and falls back to HTTP/2 (nif_loaded?
+# is hard-coded false), so the Elixir side runs fine without it, and no CI
+# builds it today. It currently does not compile: its pinned h3 0.0.6 /
+# h3-quinn 0.0.7 predate quinn 0.11's private StreamId, and with no committed
+# Cargo.lock the fresh resolve breaks. Un-quarantine only after migrating the
+# h3/h3-quinn/quinn triple to a mutually-compatible set and committing a lock.
+# Tracked as a follow-up; do not add it back to the loop until it builds.
 
 stages:
   - security
@@ -26,10 +36,10 @@ variables:
   CARGO_HOME: ${CI_PROJECT_DIR}/.cargo
   # First-party Rust crates only — opsm_ex/deps/** is vendored (Mix deps
   # cache), never linted/audited/built as our own code.
+  # quic_transport intentionally excluded — see QUARANTINED note in the header.
   RUST_CRATE_DIRS: >-
     opsm-ui/tui
     opsm_ex/native/opsm_pq_nif
-    opsm_ex/native/quic_transport
     services/checky-monkey
     services/oikos
     services/palimpsest-license
@@ -73,7 +83,6 @@ cargo-audit:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml
@@ -94,7 +103,6 @@ cargo-deny:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml
@@ -132,7 +140,6 @@ rustfmt:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml
@@ -153,7 +160,6 @@ clippy:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml
@@ -198,7 +204,6 @@ cargo-test:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml
@@ -232,7 +237,6 @@ cargo-build:
     paths:
       - opsm-ui/tui/target/release/
       - opsm_ex/native/opsm_pq_nif/target/release/
-      - opsm_ex/native/quic_transport/target/release/
       - services/checky-monkey/target/release/
       - services/oikos/target/release/
       - services/palimpsest-license/target/release/
@@ -244,7 +248,6 @@ cargo-build:
     - exists:
         - opsm-ui/tui/Cargo.toml
         - opsm_ex/native/opsm_pq_nif/Cargo.toml
-        - opsm_ex/native/quic_transport/Cargo.toml
         - services/checky-monkey/Cargo.toml
         - services/oikos/Cargo.toml
         - services/palimpsest-license/Cargo.toml