max / makenotwork

Fix the clippy and cargo_deny failures only the build host could see Both passed locally and failed in the gate, for two different reasons, and in both cases the gate was right. clippy: the build host runs rustc 1.97.1 / clippy 0.1.97 and this dev box was on 1.95.0 / 0.1.95, three months behind. useless_borrows_in_formatting widened in between, so a local green said nothing about the gate. Ran rustup update to match the host, which made the five failures reproducible: a panic! arg in tests/harness/client.rs and four format! args in workflows/synckit_adversarial.rs. Dropping the & then exposed uninlined_format_args underneath, so those four are inlined to "{app_id}/{user_id}/{hash}" rather than half-fixed. Two of these were masked until now. Run 27's clippy stopped at the first failing unit — the lib — and never reached the test binaries, so fixing the lib is what let run 28 find them. cargo_deny: it flagged docengine arriving as git+https://makenot.work/git/max/docengine.git against unknown-git = "deny". That is a real and deliberate dependency (Cargo.toml:122, a git dep so container builds need no sibling checkout, while multithreaded and GoingsOn keep path deps to the same crate), so it is allow-git rather than a code change. Worth recording why it was invisible here: ~/Code/.cargo/config.toml patches that URL and three other makenot.work git deps to local checkouts, so anything run from ~/Code resolves a patched graph and reports sources ok. The Sando worktree is under /srv/sando and inherits no such patch. Any dependency-shaped check run on this box is checking a graph that does not exist on the build host; when the two disagree, the gate is the one seeing the truth. That is now written into deny.toml where the next person will hit it. Green under the host's own toolchain: clippy --all-targets --features fast-tests -D warnings, cargo fmt --check, cargo deny (advisories/bans/licenses/sources all ok), and the suite at 1912 unit + 1222 integration, 0 failed.