ci: gate the steel-detailer-lookup crate, and fix what it had drifted into

.github/workflows/ci.yml

@@ -60,7 +60,11 @@ jobs:
       - name: Cache cargo registry + build
         uses: Swatinem/rust-cache@v2
         with:
-          workspaces: cli
+          # Two workspaces, not one: `20-agents/.../steel-detailer-lookup`
+          # declares its own `[workspace]`, so `cli`'s cache never covered it.
+          workspaces: |
+            cli
+            20-agents/aeco/engineering/steel-detailer-lookup
 
       # Same Linux build deps release.yml installs — the crate links libsecret
       # and libdbus for credential storage.
@@ -92,6 +96,26 @@ jobs:
         working-directory: cli
         run: cargo test
 
+      # `20-agents/aeco/engineering/steel-detailer-lookup` is the repo's *other*
+      # Rust crate — the deterministic clause/section lookup that ships inside
+      # every install archive next to `aware` (release.yml builds it; install.sh,
+      # install.ps1 and packaging/wix/aware.wxs all place it). It declares its own
+      # `[workspace]`, so `cd cli && cargo …` has never reached it and no gate ran
+      # on it at all: not fmt, not clippy, not its five unit tests. The only thing
+      # that ever compiled it was `cargo build --release` at release time, which
+      # runs neither clippy nor the suite.
+      #
+      # That is how it accumulated six `unwrap()` calls in non-test code against
+      # CLAUDE.md §Code style, and stayed on edition 2021 against the 2024 pin in
+      # §Tech stack, with CI green throughout. Same three gates as `cli/` above,
+      # same pinned toolchain; it links nothing, so it needs none of the apt deps.
+      - name: steel-detailer-lookup — fmt + clippy + test
+        working-directory: 20-agents/aeco/engineering/steel-detailer-lookup
+        run: |
+          cargo fmt --all -- --check
+          cargo clippy --all-targets -- -D warnings
+          cargo test
+
   # The IFC bridge is a Node package, so `cargo test` never touches it — its suite only ever ran on
   # whoever last remembered to. That is how `read-model` shipped returning a different coordinate
   # frame from `probe` (#343): the bridge's own tests encoded the wrong frame and nothing re-read

20-agents/aeco/engineering/steel-detailer-lookup/Cargo.toml

@@ -4,7 +4,10 @@ members = ["."]
 [package]
 name = "steel-detailer-lookup"
 version = "0.1.0"
-edition = "2021"
+# CLAUDE.md §Tech stack pins the language at "Rust (edition 2024)"; this crate
+# was still on 2021 because no gate compiled it. Bumped with the CI wiring that
+# now does.
+edition = "2024"
 description = "Deterministic clause-lookup CLI for steel-detailer-us, steel-detailer-uk and steel-detailer-eu AWARE agents"
 
 [[bin]]
@@ -21,3 +24,26 @@ path = "src/main.rs"
 
 [dependencies]
 serde_json = "1"
+
+[dev-dependencies]
+# Both are for the lint-gate negative control in `tests/lint_gates.rs`, and both
+# are dev-only — `cargo build --release`, what release.yml runs, never sees them.
+#
+# `tempfile` builds the scratch crates the clippy probes lint. `toml` reads the
+# `[lints.clippy]` table below, replacing a hand-rolled line-at-a-time reader
+# that missed three separate forms cargo accepts — a single-line inline table, a
+# multiline one, and a `+`-signed priority — each of which was *measured* to
+# switch the unsafe gate off with the test still green (#408). A guard for
+# "nobody re-opened this gate" has to read the manifest the way cargo does, so
+# it parses rather than pattern-matches.
+tempfile = "3.14"
+toml = "1"
+
+# CLAUDE.md §Code style: "No `unsafe` unless explicitly justified with a comment
+# block explaining the invariant." `cargo clippy -D warnings` does not enable
+# `undocumented_unsafe_blocks` — it lives in the `restriction` group — so the
+# rule needs denying by name. Mirrors `cli/Cargo.toml`, which took the same step
+# for the same reason. This crate has no `unsafe` today; the gate is what keeps
+# it that way without a review catching it.
+[lints.clippy]
+undocumented_unsafe_blocks = "deny"