fix(NATSRS-007): 4 review findings in test.yml

[flamingo]

Closes 4 review findings in .github/workflows/test.yml.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🟢 92 high	clippy check_lint job scoped only to async-nats, nats/ crate never linted	.github/workflows/test.yml:113
2	🟡 75 medium	check_lint CI job uses save-if: false on rust-cache but the cache was never populated by this job, so it always starts cold	.github/workflows/test.yml:113
3	🟡 72 medium	test.yml also installs nats-server from @main, making test results non-reproducible	.github/workflows/test.yml:37
4	🟢 92 high	check_format job runs cargo fmt on the entire workspace but check_lint only covers async-nats, creating inconsistent coverage	.github/workflows/test.yml:97

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: b6012782-a2c5-42ca-ac3b-ea9aa1fa6a7f

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

4 finding(s) fixed in this draft — 4 explained inline on the diff.

[flamingo]

🦩 🔴 clippy check_lint job scoped only to async-nats, nats/ crate never linted

Removed the defaults: run: working-directory: ./async-nats block from check_lint entirely, and changed the Run linter step from cargo clippy --benches --tests --examples --all-features -- --deny clippy::all to cargo clippy --workspace --benches --tests --examples --all-features -- --deny clippy::all. The command now runs from the repo root (no working-directory override) and covers all workspace crates including nats/ and nats-server/.

🤖 Prompt for AI agents

In .github/workflows/test.yml around line 113, review and complete this code-review fix: clippy check_lint job scoped only to async-nats, nats/ crate never linted.
What the draft fix changed: Removed the `defaults: run: working-directory: ./async-nats` block from `check_lint` entirely, and changed the `Run linter` step from `cargo clippy --benches --tests --examples --all-features -- --deny clippy::all` to `cargo clippy --workspace --benches --tests --examples --all-features -- --deny clippy::all`. The command now runs from the repo root (no working-directory override) and covers all workspace crates including `nats/` and `nats-server/`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 check_lint CI job uses save-if: false on rust-cache but the cache was never populated by this job, so it always starts cold

Added needs: [test_matrix] to the check_lint job so it runs after test_matrix has had a chance to populate the Rust build cache. This means check_lint will no longer race against test_matrix for a cold cache. Risk: check_lint now only runs after all three test_matrix matrix legs complete (ubuntu, macos, windows), which may add latency to the lint feedback. A reviewer may prefer needs: [test_matrix] scoped to only the ubuntu leg, but that is not expressible without restructuring the matrix.

🤖 Prompt for AI agents

In .github/workflows/test.yml around line 113, review and complete this code-review fix: check_lint CI job uses save-if: false on rust-cache but the cache was never populated by this job, so it always starts cold.
What the draft fix changed: Added `needs: [test_matrix]` to the `check_lint` job so it runs after `test_matrix` has had a chance to populate the Rust build cache. This means `check_lint` will no longer race against `test_matrix` for a cold cache. Risk: `check_lint` now only runs after all three `test_matrix` matrix legs complete (ubuntu, macos, windows), which may add latency to the lint feedback. A reviewer may prefer `needs: [test_matrix]` scoped to only the ubuntu leg, but that is not expressible without restructuring the matrix.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 75 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 test.yml also installs nats-server from @main, making test results non-reproducible

Pinned go install github.com/nats-io/nats-server/v2@main to go install github.com/nats-io/nats-server/v2@v2.10.24 on line 37. The version v2.10.24 is a recent stable release tag; the actual minimum supported server version for this client is not visible in this file alone, so a reviewer should verify the correct pin against the crate's documented minimum server version or latest stable release. Changed in the test_matrix job's Install nats-server step.

🤖 Prompt for AI agents

In .github/workflows/test.yml around line 37, review and complete this code-review fix: test.yml also installs nats-server from @main, making test results non-reproducible.
What the draft fix changed: Pinned `go install github.com/nats-io/nats-server/v2@main` to `go install github.com/nats-io/nats-server/v2@v2.10.24` on line 37. The version `v2.10.24` is a recent stable release tag; the actual minimum supported server version for this client is not visible in this file alone, so a reviewer should verify the correct pin against the crate's documented minimum server version or latest stable release. Changed in the `test_matrix` job's `Install nats-server` step.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 72 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 check_format job runs cargo fmt on the entire workspace but check_lint only covers async-nats, creating inconsistent coverage

This finding is resolved as a direct consequence of fix #1: by removing the working-directory: ./async-nats default from check_lint and adding --workspace, the clippy coverage now matches the full-workspace scope of check_format. No additional change was needed beyond what fix #1 already applied.

🤖 Prompt for AI agents

In .github/workflows/test.yml around line 97, review and complete this code-review fix: check_format job runs cargo fmt on the entire workspace but check_lint only covers async-nats, creating inconsistent coverage.
What the draft fix changed: This finding is resolved as a direct consequence of fix #1: by removing the `working-directory: ./async-nats` default from `check_lint` and adding `--workspace`, the clippy coverage now matches the full-workspace scope of `check_format`. No additional change was needed beyond what fix #1 already applied.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer