chore(quality): establish Rust baseline

[aaf2tbz]

Summary

Establish the Rust quality baseline for the daemon workspace and resolve the two daemon test regressions that prevented the baseline from being a true green gate. This is PR 3 of #919; it does not close the issue.

Changes

• Added a pinned Rust 1.96.1 toolchain with rustfmt and Clippy components.
• Added shared workspace lint policy and opted every Rust workspace crate into it.
• Added root rust:fmt, rust:clippy, rust:check, rust:test, rust:quality, and rust:deny commands.
• Added cargo-deny policy, workspace license inheritance, and the fixable anyhow security update.
• Resolved baseline diagnostics and isolated SQLite test databases so the core test suite can run in parallel.
• Fixed canonical transcript staging-path validation on macOS, where /tmp resolves to /private/tmp.
• Made AGENT.yaml take precedence over lowercase agent.yaml, including on case-insensitive filesystems.

Type

• feat — new user-facing feature
• fix — daemon test regressions
• refactor
• chore — build, deps, config, docs
• perf
• test — regression coverage

Packages affected

• Other: Rust daemon workspace quality tooling, dependency policy, and daemon routes

Screenshots

N/A — no UI behavior change.

PR Readiness (MANDATORY)

• Spec alignment validated (INDEX.md + dependencies.yaml)
• Agent scoping verified on all new/changed data queries
• Input/config validation and bounds checks added
• Error handling and fallback paths tested (no silent swallow)
• Security checks applied to admin/mutation endpoints
• Docs updated for API/spec/status changes
• Regression tests added for each bug fix
• Lint/typecheck/tests pass locally

Migration Notes (if applicable)

No schema or migration semantics changed. The lockfile update is backward-compatible; the two cargo-deny advisory exceptions remain documented upstream migrations with no safe update.

• Migration is idempotent
• Daemon Rust parity reviewed or explicitly N/A
• Rollback / compatibility note included

Testing

• bun run rust:fmt passes
• bun run rust:clippy passes with warnings denied
• bun run rust:check passes
• bun run rust:test passes: all workspace suites, including 199 daemon tests
• bun run rust:deny passes
• Focused regression tests pass:
  • prompt_submit_writes_transcript_audit_and_live_snapshot
  • finds_fallback_config_files
• git diff --check passes
• N/A — no running-daemon behavior changed

AI disclosure

• No AI tools were used in this PR
• AI tools were used

Notes

The former 403 transcript failure was a real canonical-path mismatch on macOS; the fallback config failure was a real filename-precedence mismatch on case-insensitive filesystems. Both are fixed in this PR. The follow-up quality-gates PR makes these local Rust commands mandatory in CI alongside supply-chain and governance protections.