nix: deny unused lint group in dedicated flake check

Catches stale #[allow(dead_code)] annotations when the code they guard
becomes live.

Author: nothingmuch

nix/checks.nix

@@ -74,6 +74,19 @@
           }
         );
 
+        unused-lints = toolchains.nightly.mkCargoDerivation (
+          commonArgs
+          // {
+            cargoArtifacts = cargoArtifactsDev;
+            CARGO_PROFILE = "dev";
+            pnameSuffix = "-unused-lints";
+            buildPhaseCargoCommand = ''
+              RUSTFLAGS="''${RUSTFLAGS:-} -D unused" cargo check --all-targets --all-features
+            '';
+            installPhase = "mkdir -p $out";
+          }
+        );
+
         no-todo-comments = pkgs.runCommand "no-todo-comments-${rev}" { inherit src; } ''
           if grep -rn --exclude-dir=contrib 'TO[D]O\|FIX[M]E' $src/ 2>/dev/null; then
             echo "FAIL: unresolved work-item markers found"
@@ -96,6 +109,7 @@
           name = "lint-checks";
           paths = [
             checks.clippy
+            checks.unused-lints
             checks.no-todo-comments
           ];
         };