chore: cargo fmt sweep + expand local settings allowlist

[avrabe]

Summary

• cargo fmt across 60 source files: line wrapping, import ordering, indentation. No semantic changes.
• cargo fmt --check exits clean on the result.
• Adds 33 entries to .claude/settings.local.json permissions.allow for routine commands (git, gh, cargo kani, rivet, zola, etc.).

Test plan

• CI passes on rust.yml
• cargo fmt --check is green
• No behavioural delta — diff is rustfmt + a JSON allowlist append

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 60.45273% with 297 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/lib/src/composition/mod.rs	54.83%	56 Missing ⚠️
src/lib/src/policy/eval.rs	63.10%	38 Missing ⚠️
src/lib/src/airgapped/verifier.rs	13.15%	33 Missing ⚠️
src/lib/src/http/mod.rs	0.00%	21 Missing ⚠️
src/lib/src/signature/keyless/format.rs	0.00%	14 Missing ⚠️
src/lib/src/sct.rs	71.11%	13 Missing ⚠️
src/lib/src/policy/slsa.rs	47.82%	12 Missing ⚠️
src/lib/src/airgapped/storage.rs	33.33%	10 Missing ⚠️
src/lib/src/signature/multi.rs	9.09%	10 Missing ⚠️
src/lib/src/airgapped/bundle.rs	43.75%	9 Missing ⚠️
... and 19 more

📢 Thoughts on this report? Let us know!

[avrabe]

Closing as superseded by the 2026-04-30 audit batch:

• Cargo fmt sweep was redone in PR fix: audit hygiene — kani cfg, version drift, docs, CI bloat #97 (audit hygiene wins)
• The settings.local.json allowlist append is session-only working state, not part of the durable settings
• Branch now conflicts with main due to the audit-driven changes

If formatting drift recurs, run cargo fmt --all and open a fresh PR.