chore: rustfmt + clippy, enforced in CI

[navbytes]

Two commits, deliberately separate so the mechanical one can be read as
mechanical:

1. chore: rustfmt and clippy, configured to the style the tree already had
   — rustfmt.toml, Cargo.toml's [lints] tables, a CI lint job,
   .git-blame-ignore-revs, and the 43 lint fixes the new rules turned up.
2. chore: apply rustfmt — cargo fmt and nothing else. 52 files,
   +1991/-1299.

rustfmt, tuned rather than imposed

roost was hand-formatted for its whole life. The config was chosen by
measuring the churn of each candidate against the existing tree, not by
taste:

config	hunks rewritten
max_width = 100	1,632
max_width = 100 + use_small_heuristics = "Max"	556
max_width = 110 + use_small_heuristics = "Max"	773

So the tree was already written to ~100 columns with everything that fits
kept on one line. rustfmt.toml is that finding written down. Stable
options only — this crate pins rust-version = "1.89" and CI runs stable,
where a nightly-only key is silently ignored, which is worse than no rule
because it reads like one.

Lints in Cargo.toml, not only in CI

[lints.rust] / [lints.clippy] apply to every local cargo check, so a
rule is visible in the editor the moment it is broken rather than twenty
minutes later on a runner. -D warnings in CI is what makes them binding.

Every lint enabled was verified to already hold. Three candidates were
measured and rejected, which is most of the value here:

• unreachable_pub — 582 hits. roost is a binary, so every pub is
  unreachable by that lint's definition, and almost all of them are in
  tests/harness/mod.rs where pub is how a shared test module offers
  anything at all. A lint that is right 0% of the time trains people to
  ignore the ones that are right.
• clippy::str_to_string — 184 hits, all asking "x".to_string() to
  become .to_owned(). Same allocation, same meaning, 184-line diff.
• trivial_casts — fires only on the FFI reference-to-pointer casts
  that make those call sites read like the C prototypes they are calling.
  Its numeric sibling has no such false-positive class, so that half stays.

What the survivors found

• clippy::undocumented_unsafe_blocks: 10 unsafe blocks with no
  SAFETY: comment. Every other one in the tree has one — this was a
  convention and it had lapsed in ten places (kill(2) in the pane sweep,
  geteuid, two mem::zeroed FFI structs, localtime_r, and the counting
  allocator in tests/scrollback_memory.rs). Now a rule, and the ten are
  written.
• elided_lifetimes_in_paths (via rust_2018_idioms): 32 sites, all
  &mut Frame / Vec<Line> / Vec<Span> in the renderer.
• trivial_numeric_casts: one 1 as PaneId where PaneId is u64.

Verification

1,047 tests and a clean clippy against the reformatted tree. Not a
formality: three of roost's gates read its own source text rather than its
behaviour — theme.rs's §2 colour ban, C34's chord-literal ban, and
srcscan::production's test-module cut — and all three depend on where a
line ends and which trailing comment sits on it (// chrome-gate-exempt is
load-bearing punctuation). A reformat is exactly the change that could have
moved a marker off its line. It did not.

Two follow-ups for the maintainer

• The lint job is not in main's required checks (those are the two
  matrix jobs). Add it in repo settings to make it blocking.
• .git-blame-ignore-revs needs the reformat's post-squash hash, which
  cannot be known before merge. I'll push that one-liner immediately after
  this lands.

vendor/vt100 is untouched throughout — it is a path dependency, not a
workspace member, so neither tool reaches it. Deliberate: reformatting
vendored code would bury roost's own patches the next time it is diffed
against upstream. CLAUDE.md's old "never run cargo fmt here" rule is
reversed in commit 1, since following it would now fail CI.