ci: add fmt/clippy/audit gates and pin toolchain to 1.97.0 (#602)

Adds quality gates to the PR workflow:
- lint job: `cargo fmt --all -- --check` and
  `cargo clippy --all-targets --all-features -- -D warnings`
  (both already clean on the current tree)
- audit job: rustsec/audit-check for dependency CVEs
- rust-toolchain.toml pinned to 1.97.0 (matches the Dockerfile) so
  local, CI, and prod builds share one compiler.

Audit triage (cargo audit found 3 vulnerabilities):
- remove_dir_all RUSTSEC-2023-0018: fixed by bumping the transitive
  tempfile 3.3.0 -> 3.27.0 (drops remove_dir_all entirely).
- rsa RUSTSEC-2023-0071 and tokio-tar RUSTSEC-2025-0111: no upstream
  fix and neither ships in the deployed binary (rsa is a phantom
  Cargo.lock entry from sqlx's unused mysql backend; tokio-tar is a
  testcontainers dev-dependency). Ignored via .cargo/audit.toml and the
  workflow's ignore input, with rationale.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nolik

.cargo/audit.toml

@@ -0,0 +1,12 @@
+# cargo-audit / rustsec advisory triage.
+# Both advisories below have NO fixed upgrade available and neither ships in
+# the deployed binary; revisit when upstream publishes a fix.
+[advisories]
+ignore = [
+    # rsa timing sidechannel (Marvin). Phantom Cargo.lock entry pulled by
+    # sqlx's unused mysql backend — not compiled into any target we build.
+    "RUSTSEC-2023-0071",
+    # tokio-tar PAX header smuggling. Dev-dependency only (testcontainers),
+    # never present in the production artifact.
+    "RUSTSEC-2025-0111",
+]

.github/workflows/build.yml

@@ -12,6 +12,16 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: Swatinem/rust-cache@v2
+      - name: Format check
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
   build:
     runs-on: ubuntu-latest
     steps:
@@ -28,3 +38,18 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Run E2E tests
         run: cargo test --tests --verbose
+
+  audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Security audit
+        uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # Advisories with no fix that don't ship in the deployed binary.
+          # Kept in sync with .cargo/audit.toml (see there for rationale).
+          ignore: RUSTSEC-2023-0071,RUSTSEC-2025-0111

Cargo.lock

@@ -0,0 +1,5 @@
+[toolchain]
+# Keep in lockstep with the Rust version pinned in the Dockerfile so local,
+# CI, and production builds all use the same compiler.
+channel = "1.97.0"
+components = ["rustfmt", "clippy"]