Hygiene Phase 3: clippy warn -> deny cleanup

[jkirsteins]

Summary

Ships Phase 3 of the Workbridge hygiene campaign: flip clippy's pedantic + nursery groups from implicit allow to warn (promoted to error via CI's -D warnings), deny the unwrap_used / expect_used / panic restriction lints in production code, and clean up every resulting finding. Leaves the crate at whole-crate clippy green so Phase 4 (src/app.rs decomposition) can begin against a clean baseline.

Design doc: docs/design/2026-04-20-workbridge-hygiene-campaign.md.
Calibration / inventory: docs/hygiene-campaign/phase-3-calibration.md.

Three commits:

1. b229889 Phase 3 prep: calibration doc, implicit budget, two-invocation clippy.
   • Baseline lint-count inventory (67 distinct lints, ~3094 raw findings) + mechanical-vs-structural classification committed as the artifact future hygiene campaigns diff against.
   • hooks/budget-check.sh + ci/file-size-budgets.toml: the previous "MISSING BUDGET ENTRIES" hard-fail is replaced by an implicit 700-line ceiling for tracked top-level src/*.rs files without explicit entries.
   • .github/workflows/ci.yml + hooks/pre-commit: single cargo clippy --all-targets -- -D warnings split into two invocations so tests can carve out unwrap_used / expect_used / panic via CLI -A flags, with zero source-level #[allow].
2. 906dec6 Phase 3 / Phase C: remove all source-level #[allow] attributes.
   • src/app.rs: two test-helper #[allow(clippy::too_many_arguments)] sites replaced by struct-bundling (ReviewItemState, LivePrPrecheckSpec).
   • src/config.rs: InMemoryConfigProvider moved into a #[cfg(test)] pub(crate) mod test_support module with a cfg-gated re-export preserving existing import paths.
   • src/work_item.rs: aspirational-but-dead items removed outright (IssueInfo::state + IssueState, WorkItemError::DetachedHead / CorruptBackendRecord / WorktreeGone).
   • src/salsa.rs / src/work_item_backend.rs / src/worktree_service.rs / src/ui.rs test module: dead variants, trait methods, and helpers removed; WorkItemBackend::backend_type() deleted along with all 19 impls (assembly derives backend type from WorkItemId).
   • After this commit, grep -rn '#\[allow\|#!\[allow' src/ returns zero.
3. c2da6fc Phase 3: pedantic + nursery + restriction lints cleanup.
   • Cargo.toml [lints] matrix: pedantic/nursery at warn with priority = -1; per-lint allows grouped into five families, each with a rationale comment (CLI surface, design-doc noise, TUI cast math, Phase-4-deferred structural, judgment-heavy rewrites / test-only patterns).
   • Mechanical cleanup via iterative cargo clippy --fix, reducing ~3,000 raw findings to zero. Restriction-lint sites (8 unwrap + 6 expect + 1 panic in production) audited one-by-one and rewritten to debug_assert! / let ... else / if let / explicit-None returns.
   • unsafe_code = "allow" crate-wide (flipped from the originally-planned warn once it surfaced that src/session.rs PTY FFI + two killpg blocks in src/app.rs would trip -D warnings with no local suppression path - source-level #[allow(unsafe_code)] is itself denied by clippy::allow_attributes). Review-based enforcement is documented in CONTRIBUTING.md "Unsafe code policy".
   • CONTRIBUTING.md gains "Lints configuration", "Unsafe code policy", and the implicit-700-line-budget note. CHANGELOG.md gains an [Unreleased] hygiene entry.

Verification (tip of branch, matching CI)

cargo clippy --bins --all-features -- -D warnings
cargo clippy --tests --all-features -- -D warnings \
    -A clippy::unwrap_used -A clippy::expect_used -A clippy::panic
cargo test --all-features                  # 772 passed
cargo +nightly fmt --all -- --check        # clean
grep -rn '#\[allow\|#!\[allow' src/        # empty
hooks/budget-check.sh                      # OK

Note: the original plan's acceptance criteria quoted cargo clippy --lib --bins ..., but workbridge has no library target, so the canonical production-code invocation is cargo clippy --bins .... Both CI (.github/workflows/ci.yml lines 41-42) and hooks/pre-commit (lines 76-77) use this form.

Authorization for deviations from review policy

• No source-level #[allow] attributes are introduced anywhere in src/. The two-invocation clippy pattern in CI + pre-commit is the mechanism that carves out unwrap_used / expect_used / panic for tests without touching source. No per-file / per-function allow authorization is required because there is no source-level allow to authorize.
• unsafe_code = "allow" at the crate level deviates from the original plan's unsafe_code = "warn". Rationale is covered in full in the c2da6fc commit message and mirrored in CONTRIBUTING.md "Unsafe code policy": warn would fire on the existing PTY FFI in src/session.rs and the two killpg blocks in src/app.rs, with no local suppression path under clippy::allow_attributes = deny. Review-based policy enforcement replaces compile-time enforcement.
• No --no-verify, no hook bypasses, no relaxation of existing rules. All git hooks ran clean on every commit.

Phase 4 pointer

The [lints] allows tagged "Phase-4-deferred structural" (needless_pass_by_value, significant_drop_tightening, struct_excessive_bools, unused_self) exist only because src/app.rs would dominate the findings. Phase 4 (src/app.rs decomposition) flips them to deny once the file is broken up.

Test plan

• cargo test --all-features passes (772 tests).
• cargo clippy --bins --all-features -- -D warnings exits 0.
• cargo clippy --tests --all-features -- -D warnings -A clippy::unwrap_used -A clippy::expect_used -A clippy::panic exits 0.
• cargo +nightly fmt --all -- --check exits 0.
• hooks/budget-check.sh passes.
• grep -rn '#\[allow\|#!\[allow' src/ returns zero.
• CI green on all jobs.

Generated with Claude Code