fix(#999): resolve all clippy warnings across the workspace

All crates now pass `cargo clippy --workspace -- -D warnings` cleanly.

Fixes span six crates (hive-sh4re, hive-ag3nt, hive-c0re, hive-forge,
hive-priv, hive-matrix-mcp was already clean):

- doc_markdown: wrap snake_case, type names, constants in backticks
- collapsible_if / collapsible_match: fold nested ifs into let-chains
- duration_suboptimal_units: Duration::from_secs(N) → from_mins/from_hours
- implicit_hasher: allow on HashMap-param fns where generalization is risky
- items_after_statements: hoist use to function tops
- map(f).unwrap_or(x) → map_or(x, f); map(f).unwrap_or_else(g) → map_or_else
- is_ok_and / is_none_or in place of map().unwrap_or(bool)
- needless_continue: {} instead of continue in loop match arms
- match_same_arms: Ok(None) | Err(_) merged
- format_push_str: write!() instead of push_str(&format!())
- while let replaces loop { let Some(..) = x else { break } }
- struct_excessive_bools / dead_code: allow on purpose-built structs
- too_many_lines / too_many_arguments: allow where refactor not worth it
- unused_async: remove async from poll_once in bash_runner
- needless_borrow: fix &repo deref in hive-forge comments verb
- cast_possible_truncation: allow u64→usize in fetch_tail

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hive-priv/src/main.rs

@@ -17,6 +17,7 @@
 //! `LISTEN_FDS=1` + `LISTEN_PID=<self>`, the inherited fd 3 is used
 //! instead of binding a fresh socket.
 
+use std::fmt::Write as _;
 use std::path::{Path, PathBuf};
 
 use anyhow::{Context as _, Result, bail};
@@ -53,6 +54,7 @@ async fn main() -> Result<()> {
 }
 
 fn socket_listener() -> Result<UnixListener> {
+    use std::os::unix::fs::PermissionsExt as _;
     // Socket activation: systemd passes the socket as fd 3 when
     // LISTEN_FDS >= 1 and LISTEN_PID matches our pid.
     let listen_fds: Option<i32> = std::env::var("LISTEN_FDS")
@@ -62,21 +64,21 @@ fn socket_listener() -> Result<UnixListener> {
         .ok()
         .and_then(|s| s.parse().ok());
 
-    if let (Some(n), Some(p)) = (listen_fds, listen_pid) {
-        if n >= 1 && p == std::process::id() {
-            // SAFETY: systemd has passed us a ready UnixListener on fd 3.
-            let std_listener = unsafe {
-                use std::os::unix::io::FromRawFd;
-                std::os::unix::net::UnixListener::from_raw_fd(3)
-            };
-            std_listener
-                .set_nonblocking(true)
-                .context("set socket non-blocking")?;
-            let listener =
-                tokio::net::UnixListener::from_std(std_listener).context("wrap systemd socket")?;
-            tracing::info!("using systemd-activated socket");
-            return Ok(listener);
-        }
+    if let (Some(n), Some(p)) = (listen_fds, listen_pid)
+        && n >= 1 && p == std::process::id()
+    {
+        // SAFETY: systemd has passed us a ready UnixListener on fd 3.
+        let std_listener = unsafe {
+            use std::os::unix::io::FromRawFd;
+            std::os::unix::net::UnixListener::from_raw_fd(3)
+        };
+        std_listener
+            .set_nonblocking(true)
+            .context("set socket non-blocking")?;
+        let listener =
+            tokio::net::UnixListener::from_std(std_listener).context("wrap systemd socket")?;
+        tracing::info!("using systemd-activated socket");
+        return Ok(listener);
     }
 
     // Fallback: bind the socket ourselves.
@@ -88,7 +90,6 @@ fn socket_listener() -> Result<UnixListener> {
     let _ = std::fs::remove_file(path);
     let listener = UnixListener::bind(path).with_context(|| format!("bind {PRIV_SOCK}"))?;
     // Mode 0660: only the hive-core group can connect.
-    use std::os::unix::fs::PermissionsExt as _;
     std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o660))
         .context("chmod priv.sock")?;
     tracing::info!(path = PRIV_SOCK, "bound priv socket");
@@ -137,6 +138,7 @@ async fn dispatch(line: &str) -> PrivResponse {
 }
 
 /// Execute a validated `PrivRequest`. Returns `(stdout, stderr)` on success.
+#[allow(clippy::too_many_lines)]
 async fn exec(req: PrivRequest) -> Result<(String, String)> {
     match req {
         PrivRequest::StartContainer { ref name } => {
@@ -248,9 +250,9 @@ async fn exec(req: PrivRequest) -> Result<(String, String)> {
         }
 
         PrivRequest::ChmodSocketDir { ref agent_name, mode } => {
+            use std::os::unix::fs::PermissionsExt as _;
             validate_agent_name(agent_name)?;
             let path = socket_dir_path(agent_name);
-            use std::os::unix::fs::PermissionsExt as _;
             std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode))
                 .with_context(|| format!("chmod {:o} {}", mode, path.display()))?;
             Ok((String::new(), String::new()))
@@ -404,6 +406,6 @@ fn write_nspawn_flags(container: &str, binds: &[BindMount]) -> Result<()> {
         format!("{flag}={}:{}", b.host_path, b.container_path)
     }).collect();
     let flags_joined = flags.join(" ");
-    out.push_str(&format!("EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"\n"));
+    writeln!(out, "EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"").unwrap();
     std::fs::write(&path, out).with_context(|| format!("write {path}"))
 }