Add rustfmt, clippy, type-check and test gates to CI

[adbarc92]

CI gated on three things: the embargo guard, cargo test --workspace, and the cross-platform tauri build matrix. No linting, no formatting check, no frontend gate of any kind — and, it turns out, no coverage of the cockpit crate's tests or the vitest suite. This adds five jobs and clears what they surfaced.

All 9 jobs green on this branch, including the untouched 3-OS build matrix.

The two-workspace problem

cockpit/ui/src-tauri/Cargo.toml opens with an empty [workspace] table, making it a standalone cargo workspace. The root manifest lists only crates/fleet-core and crates/fleetd as members. Nothing invoked from the repo root — not --workspace, not --all — reaches that crate.

The existing cargo test (workspace) job therefore ran 120 tests from crates/ and zero of the cockpit crate's 26. That suite covers the app-plugin state machine, manifest validation and discovery, and until now was verified only by hand. Every Rust gate below runs once per manifest for the same reason.

Gates added

Job	Gate	Root workspace	cockpit/ui/src-tauri
fmt + clippy	cargo fmt -- --check	yes	yes (via --manifest-path)
fmt + clippy	cargo clippy --all-targets -- -D warnings	yes	yes (via working-directory)
svelte-check + tsc	npm run check	—	—
vitest (cockpit/ui)	npm test	—	—
cargo test (cockpit)	cargo test	(already gated)	yes

npm run check resolves to svelte-check --tsconfig ./tsconfig.app.json && tsc -p tsconfig.node.json. There is no ESLint in this project, so there is no lint gate to add on the frontend side.

The vitest job closes a half-gated pair, not just a coverage gap: the regression pin for the plugin_launch main-thread freeze is split across a Rust test (now covered by cargo test (cockpit)) and cockpit/ui/src/App.appPlugin.test.ts (covered here). That file is not on main yet — it lands with the plugin-runtime work — so this job gates 91 tests today and picks up the JS half of the pin the moment it merges.

Compiling the tauri crate needs the WebKitGTK system deps the tauri build job already installs, plus the fleetd sidecar binary — tauri-build resolves the externalBin resource at compile time and hard-errors without it. Both the lint and cockpit-test jobs repeat that setup (apt deps, npm ci, npm run sidecar). rustfmt needs none of it, so both fmt checks run first and fail fast.

Existing jobs are untouched; build still gates on test only.

Debt cleared

style: apply cargo fmt — neither workspace had ever been run through rustfmt, so this is the entire backlog in one pass: 34 files, +2486/-642, all whitespace. There is no rustfmt.toml; these are stock defaults, mostly struct literals and multi-arg calls being split across lines. Kept in its own commit so it does not bury the real fixes.

fix(cockpit): clear clippy debt — the root workspace was already clean under -D warnings. The cockpit crate had twelve findings. Three were real:

• nonminimal_bool in the discovery filter — the pruned test is now a named binding instead of a negated conjunction
• two unnecessary_to_owned (&"audience".to_string()) in the check_crash tests

The other nine are dead_code, each carrying a narrowly scoped #[allow(dead_code)] with a comment. No blanket allows, nothing at module or crate level. Deleting the code would amputate work in flight on #49, so it stays — but the comments distinguish two very different situations, verified by grep across origin/main and origin/feat/plugin-runtime:

Genuinely awaiting a caller (verified to exist):

Site	Caller
PluginManager::url_for	embedding.rs:99 on feat/plugin-runtime

Unwired features with no caller on any branch — read only by test assertions, if at all. The comments say so plainly, so the allow cannot become the permanent resting place of unbuilt work:

Site	Reality
state::check_crash	only its own two unit tests; nothing destroys the webview of a plugin whose process dies
Spawner::has_exited	reachable only via check_crash, so dead with it; the real impl has never run outside a test
Manifest::webview	read only by test assertions
WebviewCfg (popups, external_links, title)	read only by test assertions — a plugin author setting popups: block gets no blocking
Manifest::window_title	one test assertion, no production caller

Not independently verified — comments left as originally written, and each already states plainly that nothing reads the item today: Running::child_id (written at launch, never read back), Lifecycle::managed (accepted, not acted on), Spawner::kill (documented force-kill fallback), state::STOPPED (rest state, never emitted).

test(cockpit): give each local_projects test its own temp dir — a pre-existing flake the new gate would have inherited. tmp() keyed its directory on the process id alone, so all four local_projects tests shared one path while running concurrently in the same binary; one test's remove_dir_all raced another's create_dir_all. Measured 5 failures in 20 runs on Windows before, 0 in 30 after. An atomic counter makes each directory unique. Test-only, no production code touched.

test(cockpit): make the absolute-cwd test pass off Windows — caught by the first CI run, which is the first time this suite has ever executed on Linux. keeps_absolute_cwd_as_is leaned on the AUDIENCE_JSON fixture's D:/… cwd, which Path::is_absolute only calls absolute on Windows; elsewhere resolved_cwd correctly joins it to the manifest dir and the assertion fails. Production code is right — only the test baked in a platform. It now picks an absolute path the host agrees with.

Verification

Green in CI on ubuntu, and run locally on Windows against the final tree:

cargo fmt --all -- --check (both)	pass
cargo clippy --workspace --all-targets -- -D warnings	pass
cargo clippy --all-targets -- -D warnings (cockpit)	pass
npm run check	342 files, 0 errors, 0 warnings
cargo test --workspace	120 passed, 3 ignored (Docker ITs)
cargo test (cockpit)	26 passed
npm test	91 passed, 13 files

Behavior is unchanged: the clippy fixes are semantics-preserving rewrites, both test fixes touch only test code, and the comment corrections touch only comments. Test counts differ from the operator's hand-recorded figures (28 Rust / 135 JS) because those were taken on feat/plugin-runtime; this branch is cut from origin/main.

Note for the operator

No rustfmt.toml. Stock defaults are what the new gate enforces. use_small_heuristics = "Max" would have roughly halved the formatting diff (measured: +1185/-483 vs +2486/-642) by preserving the compact struct literals the code was written with — worth a look if that style was deliberate, but it is a config choice for the repo owner, not one to make inside a CI PR.

The 34-file formatting commit will conflict with feat/plugin-runtime. That is known and left for the operator to sequence; nothing on that branch was touched here.