fix(ci): green the remaining gates and rebuild the config files honestly

[hyperpolymath]

Follow-on to #129. That PR made the two dead gates run; this one makes the remaining four checks pass, and replaces four config files that a sweep had overwritten with generic estate boilerplate.

Gates

Rust CI — clippy -D warnings (was exit 101)

~32 lints. Most came straight from cargo clippy --fix. Two groups needed judgement:

• 19 × &[x.clone()] → std::slice::from_ref(&x) — single-element slices; drops a needless clone.
• 5 × clippy::approx_constant — a false positive. Every hit is the literal 3.14 used as arbitrary decimal test data: abs(-3.14) == 3.14, a JSON float round-trip, a channel send/receive. None of them mean π. Substituting std::f64::consts::PI would change what the tests assert, so the test modules carry a narrowly scoped #[allow] with the reason written beside it.

This failure was masking three other jobs. Cargo audit, Cargo test and Coverage were all skipped behind it. Tests now actually run: 236 pass, 0 fail.

Cargo Audit + Security — RUSTSEC-2026-0190

Both were red on the same advisory (unsoundness in anyhow's Error::downcast_mut()).

The plan was a time-boxed audit.toml ignore. It turned out not to be needed: anyhow is transitive and 1.0.104 is released, so this is a real fix. Bumped 1.0.102 → 1.0.104; cargo audit -D warnings now exits 0. No suppression file added.

ClusterFuzzLite — open Dockerfile: no such file or directory

.clusterfuzzlite/ holds a Containerfile per the estate's podman-first naming, but ClusterFuzzLite hardcodes .clusterfuzzlite/Dockerfile. Added Dockerfile as a symlink to Containerfile (git mode 120000), so the tool finds the name it demands while the estate convention remains the single source of truth.

Config files

These carried generic multi-language boilerplate that didn't describe this repo — and in two cases actively contradicted it.

File	What was wrong
mise.toml	rust = "latest" against rust-toolchain.toml's deliberate 1.96.0 pin; declared node/python/go/java/bun/npm/yarn/pnpm/pip — all BANNED by this repo's own .claude/CLAUDE.md; [alias] chained cargo test || npm test || go test ./...
.tool-versions	rust stable — same contradiction
.editorconfig	Covered Elixir/ReScript/Zig/Ada; omitted Lean, Coq, ocamllex/menhir and .woke/.wl
.gitattributes	Same — absent languages in, present languages out
.gitignore	Cruft for absent languages; missing *.olean, *.ilean, .lake/, Idris *.ttc
guix.scm	Licence field that could never have evaluated

Two of these deserve spelling out.

The mise.toml alias block was a fake gate by construction. test = "cargo test || npm test || go test ./..." converts a genuine cargo test failure into an attempt at two toolchains that don't exist here. The pin contradiction matters for the same reason: rust-toolchain.toml documents that a drifting stable once broke this very clippy gate with lints local clippy couldn't see.

guix.scm's licence was broken two ways:

(license ((@@ (guix licenses) license) "MPL-2.0" "..."))

@@ reaches into a non-exported binding, and the license record constructor takes three fields but was given two. Because guix isn't installed on the development host, nothing ever evaluated this file and the fault sat unnoticed. Now (license mpl2.0) — what (guix licenses) actually exports. Confirmed the file parses under guile and that the old form raises unbound-variable.

.gitignore was checked both directions: no currently tracked file becomes ignored, and the tracked examples/math.wasm fixture is explicitly re-included.

Verified locally

cargo clippy --workspace --all-targets -- -D warnings   PASS
cargo fmt --all -- --check                              PASS
cargo test --workspace                                  PASS (236 tests)
cargo audit -D warnings                                 PASS
guix.scm parses under guile                             PASS
all 22 workflows structurally valid for Actions         PASS
no tracked file newly ignored                           PASS

🤖 Generated with Claude Code