Format the tree with rustfmt and add the lint + supply-chain gates
sando: seal tier-state forward-advance; WAL+busy_timeout; lock /confirm (Run 2 S1/F2/F3)