feat(devex): raise the quality bar for AI-assisted contributions

Motivation

RTK contributions are mainly delegated to AI coding agents (Claude Code, Cursor, Copilot, etc.). In that context, the quality of the Rust codebase matters more than usual — the agent can't visually review its output, it relies entirely on static analysis to catch issues.

The current lint pipeline (cargo clippy --all-targets -- -D warnings) only covers Clippy's default group. Three high-value groups are completely invisible today, and two common supply chain checks are absent. This means an AI agent generating a PR can introduce idiomatic Rust violations, unused deps, broken doc links, or even a CVE — and nothing in CI will catch it.

Proposed changes

1. clippy::pedantic + clippy::nursery

Enable the two opt-in Clippy groups that catch idiomatic Rust violations:

```
cargo clippy --all-targets -- -D warnings -W clippy::pedantic -W clippy::nursery
```

The first run surfaces ~2,100 warnings. Most are mechanical fixes (format string inlining, unnecessary raw string hashes, redundant closures, single-char patterns) applied automatically.

Lints that are legitimately inapplicable to a CLI proxy are suppressed in a single #![allow(...)] block at the top of src/main.rs, each with a comment explaining why:

Open to discussing any of these before landing — especially the "established patterns" row, which represents real technical debt rather than genuine false positives.

2. cargo-deny — supply chain security

Add a deny.toml covering:

• Advisories: deny known CVEs and yanked crates
• Licenses: explicit allowlist (MIT, Apache-2.0, BSD-*, ISC, MPL-2.0, Zlib…)
• Bans: deny tokio, async-std, futures — enforces RTK's no-async rule at tooling level, not just documentation
• Sources: crates.io only, deny unknown registries and git deps

3. cargo-machete — unused dependencies

Detects unused entries in Cargo.toml. On RTK's current dep tree nothing is removed (all 21 deps are in use), but the check catches future drift.

4. rustdoc -D warnings

```
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features
```

Catches broken intra-doc links and malformed doc comments. One issue found in the current codebase (<path> in a doc comment interpreted as an HTML tag).

Integration

All four checks wired into CI and a local task:

```
mise run qa → fmt:check + lint + test + doc + machete + deny
```

Questions for discussion

• Crate-level #![allow(...)]: is the table above acceptable as-is, or do you want to address some of these before landing?
• multiple-versions = "warn" vs "deny": the windows-sys family ships 4 simultaneous versions via transitive deps (dirs, ring, colored, clap). Worth trying to reduce, or skip and warn?
• clippy::nursery: some nursery lints are experimental and occasionally noisy. Open to dropping it and sticking with just pedantic if you'd prefer a more stable baseline.

Out of scope for this PR

• lazy_static! → std::sync::LazyLock migration (23 usages — separate modernization task)
• push_str(&format!(...)) → write!() migration (263 usages — separate task)
• Fixing too_many_arguments on run() entry points (requires API design decisions)

A working implementation is available on branch devex/alignment-claude-hook.

Review the proposed quality checks in src/main.rs, Cargo.toml, deny.toml, and the existing CI and mise configuration, then inspect the available chore/quality-gate branch. Run the listed Clippy, cargo-deny, cargo-machete, and rustdoc commands to identify remaining warnings and policy decisions. Done means all four checks are wired into CI and mise run qa without warnings, while documented exceptions and out-of-scope migrations remain excluded.