sando: key gate evidence on the build, not the version string
sando: auxiliary-repo checkout so cross-repo path deps resolve
sando: adopt lint block, fix clippy, fmt
Format the tree with rustfmt and add the lint + supply-chain gates