chore(ci): deny warnings and make clippy pass mandatory in ci

.claude/agents/rust-rtk.md

@@ -397,7 +397,7 @@ docker run --rm -v $(pwd):/rtk -w /rtk rust:latest cargo test  # Linux via Docke
 ✅ **DO** compile regex once with `lazy_static!`
 ✅ **DO** verify token savings claims in tests (≥60%)
 ✅ **DO** test on macOS + Linux + Windows (via CI or manual)
-✅ **DO** run `cargo fmt && cargo clippy && cargo test` before commit
+✅ **DO** run `cargo fmt && cargo clippy --all-targets && cargo test` before commit
 ✅ **DO** benchmark startup time with `hyperfine` (<10ms target)
 ✅ **DO** use `anyhow::Result` with `.context()` for all error propagation
 

.claude/commands/tech/codereview.md

@@ -230,12 +230,12 @@ Glob tests/fixtures/<cmd>_raw.txt
            └────────┬────────┘
                     │
                     ▼
-           ┌──────────────────────┐
-           │  3. Quality gate     │
-           │  cargo fmt --all     │
-           │  cargo clippy        │
-           │  cargo test          │
-           └────────┬─────────────┘
+     ┌─────────────────────────────┐
+     │  3. Quality gate            │
+     │  cargo fmt --all            │
+     │  cargo clippy --all-targets │
+     │  cargo test                 │
+     └──────────────┬──────────────┘
                     │
               Loop ←┘ (max N iterations)
 ```

.github/workflows/CICD.md

@@ -10,17 +10,16 @@ Trigger: pull_request to develop or master
                           └────────┬─────────┘
                                    │
                           ┌────────▼─────────┐
-                          │       fmt         │
+                          │    fmt --all     │
                           └────────┬─────────┘
                                    │
-                          ┌────────▼─────────┐
-                          │ clippy            │
-                          │ -D unsafe_code    │
-                          └┬───┬───┬───┬───┬─┘
+                       ┌───────────▼──────────┐
+                       │ clippy --all-targets │
+                       └───┬───┬───┬───┬───┬──┘
                            │   │   │   │   │
-           ┌───────────────┘   │   │   │   └───────────────┐
-           │       ┌───────────┘   │   └──────────┐        │
-           ▼       ▼               ▼              ▼        ▼
+           ┌───────────────┘   │   │   │   └────────────────┐
+           │       ┌───────────┘   │   └───────────┐        │
+           ▼       ▼              ▼               ▼        ▼
      ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌─────────┐ ┌──────────┐
      │ test     │ │ security │ │ semgrep   │ │benchmark│ │ doc      │
      │ ubuntu   │ │ cargo    │ │ AST-aware │ │ >=80%   │ │ review   │

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets -- -D unsafe_code
+      - run: cargo clippy --all-targets
 
   # ─── Parallel gates (all need code to compile) ───
 
@@ -220,7 +220,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version: 'stable'
+          go-version: "stable"
 
       - name: Install Go tools
         run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
@@ -228,7 +228,6 @@ jobs:
       - name: Run benchmark
         run: ./scripts/benchmark.sh
 
-
   # ─── AI Doc Review: develop PRs only ───
 
   doc-review:

Cargo.toml

@@ -65,3 +65,7 @@ assets = [
 assets = [
     { source = "target/release/rtk", dest = "/usr/bin/rtk", mode = "755" },
 ]
+
+[lints.rust]
+unsafe_code = "deny"
+warnings = "deny"