test + ci: workspace unit coverage, cargo-matrix/nextest pipeline, and CI/dep refresh

[CraZySacX]

Summary

Add the first-ever unit tests to all three Barto binaries (bartoc, barto-cli, bartos) and the libbarto doctests, migrate the test/coverage pipeline to cargo-matrix, switch CI tests to cargo-nextest, and refresh pinned action SHAs and workspace dependencies for the v1.5.11 release.

• bartoc — 57 tests across 7 modules (first tests ever in this crate)
• barto-cli — 43 tests across 5 modules (first tests ever in this crate)
• bartos — ~36 tests across 7 modules (first tests ever in this crate)
• Mark live-I/O code (needs a running bartos, MariaDB, platform keychain, or OS signals) with #[cfg_attr(coverage_nightly, coverage(off))] so it doesn't drag down coverage
• Harden the barto-cli handler display arithmetic with saturating_sub (and max(1) on the print_height modulo divisor) so a narrow/headless terminal no longer panics on underflow
• cargo-matrix migration — add [package.metadata.cargo-matrix] default/coverage channels to all four crates (the coverage channel always_includes unstable); run_all.fish / run_all.ps1 now run tests via cargo matrix nextest run (+ libbarto doctests) and coverage via cargo matrix -c coverage llvm-cov nextest --no-report
• barto-cli: enable unstable = ["libbarto/unstable"]
• Dependency updates (depsup); pin alloc-no-stdlib due to an upstream packaging issue

CI & dependency refresh

• Tests now run under cargo-nextest in CI — bump the rustyhorde/workflows reusable-workflow pin to 60c2f58 (which adds optional nextest support) and set nextest: true on the three 🧪 Test jobs, matching the local pipeline. Coverage already uses nextest via COVERAGE_RUN_CMD. Job names are unchanged, so the master ruleset required-status-check list needs no update.
• Refresh third-party action pins in release.yml / audit.yml:
  • Wandalen/wretry.action → e68c23e (v3.8.0)
  • actions/checkout → df4cb1c (v6.0.3)
  • cargo-bins/cargo-binstall → 252c5e7 (main)
  • rustyhorde/audit-check → a6c4633 (v0.3.0 → v1.0.0; retains the token/deny/create_issue inputs)
• Workspace dependency bumps: bon 3.9.1 → 3.9.2, getset 0.1.6 → 0.1.7, time 0.3.47 → 0.3.49, uuid 1.23.1 → 1.23.3, pin rpassword 7.5.4 and notify-debouncer-mini 0.7.0; promote regex to a workspace dependency (1.12.4) referenced from bartos and libbarto.

bartoc modules covered

Module	Tests	What
error.rs	9	All error Display strings
db/data/output.rs	9	OutputKey/OutputValue From<&Output> + Display
db/data/status.rs	8	StatusKey/StatusValue From<&Status> + Display
handler/stream.rs	7	HMAC replay-nonce protection logic
db/mod.rs	8	redb write/flush round-trips, cleanup, compaction
config/mod.rs	3	Path resolution with and without CLI override
runtime/cli.rs	13	All CLI flags and PathDefaults/PathDefaultsExt defaults

barto-cli modules covered

Module	Tests	What
error.rs	3	All error Display strings
runtime/cli.rs	~20	Flag/subcommand parsing, Source::collect, PathDefaults
config/mod.rs	4	Getters/setter and TracingConfig/TracingConfigExt impls
handler/mod.rs	8	maxes_* width calcs, handle_message, handle_binary dispatch
runtime/mod.rs	8	build_message for every Commands variant

bartos modules covered

Module	Tests	What
common/mod.rs	5	Clients add/remove/by-name/add-data, WorkerSignal equality
config/mod.rs	3	Defaults + TracingConfig/TracingConfigExt impls
error.rs	3	All error Display strings
db/utils.rs	4	apt/garuda/pacman/cachyos update-output filters
endpoints/insecure/mod.rs	3	Name / ip / describe helpers
endpoints/insecure/worker.rs	4	build_init_bytes, build_cleanup_bytes, sign_worker_payload
runtime/cli.rs	~11	All CLI flags, Source::collect, PathDefaults

Skipped / coverage-off (require live network, keychain, MariaDB, OS signals, or full runtime): bartoc runtime/mod::run, Handler::handle/wait_for_close, runtime/secrets.rs keyring fns, service.rs (Windows-only); bartos runtime/mod setup/server/signal/watcher fns, db/mysql handler, endpoints/insecure/{cli,worker} async handlers, handler/cli impl.

Test plan

• cargo matrix nextest run — all tests pass
• scripts/run_all.fish --no-install --no-musl — full CI pipeline passes (no lint errors)
• CI green on this PR with the new nextest test step and refreshed action pins

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 98.51043% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.44%. Comparing base (a09dda7) to head (2fa1bac).

Files with missing lines	Patch %	Lines
barto-cli/src/runtime/cli.rs	93.28%	9 Missing ⚠️
barto-cli/src/handler/mod.rs	95.61%	5 Missing ⚠️
barto-cli/src/runtime/mod.rs	98.63%	1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (a09dda7) and HEAD (2fa1bac). Click for more details.

HEAD has 4 uploads less than BASE

Flag	BASE (a09dda7)	HEAD (2fa1bac)
	8	4

Additional details and impacted files

@@             Coverage Diff             @@
##           master     #259       +/-   ##
===========================================
- Coverage   97.57%   84.44%   -13.13%     
===========================================
  Files          31       57       +26     
  Lines        4858     7979     +3121     
===========================================
+ Hits         4740     6738     +1998     
- Misses        118     1241     +1123     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.