refactor(#3245): move the rustdoc lints into the workspace lint table

mara asked whether these can live in Cargo.toml. They can, and they
should: [workspace.lints.rustdoc] sits alongside the existing clippy
table, every crate already opts in via `[lints] workspace = true`, and
the toolchain is well past the 1.74 that introduced lint tables.

The reason it is better than RUSTDOCFLAGS on the check: a plain local
`cargo doc` now fails exactly the way CI does. Setting the lints only in
the nix derivation would have made CI the one place the gate exists,
which is the same "you meet it too late" problem the gate was written to
solve.

The check keeps --workspace --no-deps --document-private-items and drops
the RUSTDOCFLAGS block entirely.

Verified by mutation rather than assumption, with no RUSTDOCFLAGS set
anywhere: clean tree exits 0; reintroducing one broken link makes
`cargo doc -p hive-jobq` exit 101 with `error: public documentation for
Outcome links to private item Scheduler::complete`. An error rather than
a warning is the proof the deny came from the lint table.

Cargo.toml

@@ -41,6 +41,23 @@ missing_panics_doc = "allow"
 module_name_repetitions = "allow"
 must_use_candidate = "allow"
 
+[workspace.lints.rustdoc]
+# Doc-link rot has no other discoverer: clippy does not read intra-doc
+# links, `cargo test` does not, and nothing else builds docs. A `[`Foo`]`
+# pointing at a renamed, moved or deleted item renders as plain text and
+# misleads the next reader — worse than no link, since it names something
+# and so sends them looking.
+#
+# Here rather than in `RUSTDOCFLAGS` on the CI check, so a plain local
+# `cargo doc` fails the same way CI does. A gate you only meet in CI is a
+# gate you meet too late.
+broken_intra_doc_links = "deny"
+private_intra_doc_links = "deny"
+invalid_html_tags = "deny"
+redundant_explicit_links = "deny"
+bare_urls = "deny"
+unescaped_backticks = "deny"
+
 [workspace.dependencies]
 anyhow = "1"
 libc = "0.2"