[codex] ci: harden wasm SIMD gates

.github/workflows/ci.yml

@@ -321,7 +321,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (2026-03-27)
         with:
           toolchain: stable
-          targets: wasm32-unknown-unknown, wasm32-wasip1
+          components: clippy
+          targets: wasm32-unknown-unknown, wasm32-wasip1, aarch64-unknown-linux-gnu
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: install wasmtime (executes the wasip1 test binary)
         # Pinned release + sha256 verification, instead of `curl | bash` of an
@@ -341,19 +342,30 @@ jobs:
           echo "${sha256}  ${tarball}" | sha256sum -c -
           tar xJf "${tarball}"
           echo "${PWD}/wasmtime-${WASMTIME_VERSION}-${arch}-linux" >> "${GITHUB_PATH}"
-      # RUSTFLAGS is overridden here (dropping the workflow-level -D warnings)
-      # so a warning in rayon's wasm-only code path can't fail the build; the
-      # crate's own code is held to -D warnings by the lint/test jobs on the
-      # same source, and clippy covers the simd128 path locally.
+      # `--no-deps` keeps clippy scoped to this crate; Cargo still compiles
+      # dependencies with its usual `--cap-lints allow`, so third-party
+      # target-only warnings cannot mask warnings in ordvec's cfg-gated code.
+      - name: clippy wasm32-unknown-unknown + simd128 (-D warnings)
+        env:
+          RUSTFLAGS: -D warnings -C target-feature=+simd128
+        run: cargo clippy -p ordvec --lib --target wasm32-unknown-unknown --no-deps -- -D warnings
+      - name: clippy aarch64 NEON (-D warnings)
+        env:
+          RUSTFLAGS: -D warnings
+        run: cargo clippy -p ordvec --lib --target aarch64-unknown-linux-gnu --no-deps -- -D warnings
       - name: build wasm32-unknown-unknown + simd128 (browser / edge target)
         env:
-          RUSTFLAGS: -C target-feature=+simd128
+          RUSTFLAGS: -D warnings -C target-feature=+simd128
         run: cargo build --lib --target wasm32-unknown-unknown
       - name: run the simd128 popcount kernel test under wasmtime
         env:
-          RUSTFLAGS: -C target-feature=+simd128
+          RUSTFLAGS: -D warnings -C target-feature=+simd128
           CARGO_TARGET_WASM32_WASIP1_RUNNER: wasmtime
-        run: cargo test --lib --target wasm32-wasip1 popcount_helpers_match_naive
+        run: |
+          set -euo pipefail
+          log="${RUNNER_TEMP}/wasm-popcount-test.log"
+          cargo test --lib --target wasm32-wasip1 util::tests::popcount_helpers_match_naive -- --exact 2>&1 | tee "$log"
+          grep -Eq 'test result: ok\. 1 passed;' "$log"
 
   # ----------------------------------------------------------------------
   # Benchmark visibility (not a pass/fail perf gate). Runs the self-contained