[Linuxuser67]

Follow-up to #548, covering the remaining findings from the audited review of main at 6de8538. Finding 8 (file/test-file size) is out of scope and stays shelved.

Changes

• Strict hex decoding (src/extension_server.rs): hex_decode now rejects anything that is not an ASCII hex digit. u8::from_str_radix accepts a leading +, so "+f" and "0f+0" decoded successfully before. Added a unit test for those inputs (and for odd-length / non-hex).
• SAFETY comments (src/video_tools.rs): documented the two unsafe blocks in real_home_dir — sysconf (no pointers) and CStr::from_ptr(entry.pw_dir) (non-null after a successful getpwuid_r, bytes copied before the buffer can change).
• Poison handling (src/gallery_runner.rs): the two stderr-tail locks now go through runtime::lock_recover like every other worker-shared mutex, instead of .lock().unwrap(). A panicking stderr task can no longer take the download down with it.
• Suppression reasons: every suppression now carries a reason, and the live clippy::too_many_arguments, clippy::type_complexity and clippy::needless_borrow suppressions are #[expect(..., reason = "...")], so a future clippy that stops firing them fails the build instead of leaving dead allowances behind. Dropped the four too_many_arguments allowances that no longer fire (their functions take at most 7 arguments). The test-module await_holding_lock stays an allow (test-only by design) but now has a reason.
• Legacy branch removal date (src/extension_server.rs): the paired-extension compatibility branch is now dated for removal after 2027-03-01. Adjust the date if it does not match the extension's update window.
• Tombstone removal (src/runtime.rs): deleted the empty #[cfg(test)] mod tests that only documented a deleted test.

Findings #4 (naming) and #7 (serial-test docs) needed no code: CONTRIBUTING.md already documents RUST_TEST_THREADS=1 and the serial test run.

Verification

• No Rust toolchain is available in this environment, so cargo fmt --check, cargo clippy and the test suite were not run locally; CI is the gate.
• git diff --check is clean.
• The first CI run confirmed the type_complexity suppression is still live at clippy 1.99 (the earlier local score estimate of 200 was wrong), so it is kept as an #[expect].
• Note: the needless_borrow suppression documents a clippy false positive inside let-chains (1.99). If clippy fixes it, the new #[expect] will flag the stale suppression — that is the intended behavior.