fix(ci): unblock nix flake check after clippy 0.1.95 bump (#1368)

The nixpkgs bump to clippy 0.1.95 / cargo 1.95.0 added + strengthened a
large batch of lints. CI denied ALL warnings (`-D warnings`) against the
`pedantic = warn` workspace lint, so the bump hard-failed `nix flake
check` workspace-wide with zero code changes — and would recur on every
future clippy bump.

Posture fix (the durable part): CI now runs
`-D warnings -A clippy::pedantic`, so the default/correctness/style lints
stay a hard gate while the "extra, opinionated" pedantic group is
advisory only (still `warn` for local `cargo clippy` via the workspace
lints table, just non-blocking in CI). `-A` rather than `-W` so the
group drop doesn't re-enable the specific pedantic lints the workspace
allows (e.g. `must_use_candidate`).

Also fixes the genuine DEFAULT/STYLE lints the bump surfaced across the
workspace (doc_lazy_continuation, collapsible_if, ptr_arg,
match_like_matches_macro, …) via `cargo clippy --fix` + manual stragglers
(`too_many_arguments` #[allow] on the host-config constructors), and
three tests that had rotted while the CI runner was offline (#1221):
- topology::top_level_agents_in_multi_root — hardcoded unsorted expected
- rebuild_queue::depends_on_evicted_dep_counts_as_resolved — needs
  MAX_HISTORY_PER_KIND newer terminals to evict, not one
- coordinator::agent_paths doctest — illustrative pseudo-code, now `ignore`

Validated: clippy + formatting + cargo-test checks all pass.

flake.nix

@@ -320,18 +320,29 @@
           formatting = treefmt-eval.config.build.check self;
           # Clippy as a check via crane's first-class `cargoClippy`
           # builder. Reuses the shared `cargoArtifacts` (deps already
-          # built) and runs `cargo clippy --workspace --all-targets
-          # -- -D warnings` directly — no `overrideAttrs` hack needed,
-          # because crane parses `cargoClippyExtraArgs` correctly
-          # (naersk's `mode = "clippy"` used to mangle the `--`
-          # separator, which is why the old wiring went through
-          # overrideAttrs).
+          # built) and runs `cargo clippy --workspace --all-targets`
+          # directly — no `overrideAttrs` hack needed, because crane
+          # parses `cargoClippyExtraArgs` correctly (naersk's
+          # `mode = "clippy"` used to mangle the `--` separator, which
+          # is why the old wiring went through overrideAttrs).
+          #
+          # `-D warnings` makes the default/correctness/style lints a
+          # hard CI gate. `-A clippy::pedantic` then drops the pedantic
+          # group from that gate: pedantic is the "extra, opinionated"
+          # group the clippy team grows freely, so denying it means
+          # every toolchain bump that adds a new pedantic lint breaks CI
+          # with zero code changes (#1368). The `pedantic = warn`
+          # workspace lint (Cargo.toml) keeps it as advisory signal in
+          # local `cargo clippy` — it just no longer blocks the build.
+          # (`-A` rather than `-W` here: `-W clippy::pedantic` would
+          # re-enable the specific pedantic lints the workspace lints
+          # table allows, e.g. `must_use_candidate`.)
           clippy = craneLib.cargoClippy {
             src = cleanSrc;
             inherit cargoArtifacts nativeBuildInputs;
             pname = "hyperhive-workspace";
             version = "0.1.0";
-            cargoClippyExtraArgs = "--workspace --all-targets -- -D warnings";
+            cargoClippyExtraArgs = "--workspace --all-targets -- -D warnings -A clippy::pedantic";
           };
           # `cargo test --workspace` lifted out of `buildPackage` so the
           # `hyperhive-assets` dep (which `hive-ag3nt::prompt::tests`