clippy: fix lints that crane's cargoClippy properly enforces (#538)

The naersk → crane swap in the parent commit flips clippy from
silently passing to actually failing on `-D warnings` (naersk's
`mode = "clippy"` mangled the `--` separator so the deny never took
effect). This commit clears the surfaced lints so the workspace
builds clean under the new enforcement — every fix is mechanical and
preserves behaviour. Tests still pass (160 across the workspace).

Auto-fixes via `cargo clippy --fix`:
- `doc_markdown` (19 sites): bare identifiers in doc comments
  wrapped in backticks
- `format_in_format_args`, `explicit_into_iter_loop`,
  `redundant_closure_for_method_calls`, `useless_conversion`, and
  a few more — mechanical rewrites of the kind cargo can apply
  safely.

Hand-fixed:
- `match_same_arms` (forge_notify::is_atx_heading): two arms returning
  `true` collapsed into a single `matches!` pattern.
- `cast_sign_loss` + `format_push_string` (mcp.rs status formatter):
  guarded `i64 → u64` through `u64::try_from(…).unwrap_or(0)` (status
  timestamps are always positive in practice; clamp the skew edge to
  0) and swapped `out.push_str(&format!(…))` for `write!` into the
  buffer with an infallible-writer `let _ =`.
- `doc_lazy_continuation` in turn.rs + manager_server.rs + sh4re/lib.rs:
  doc paragraphs that the markdown parser was treating as list-item
  continuations got either a separating blank line or a `/`-for-`+`
  word swap so the parser stops seeing a list.
- `unused_async` (manager_server::handle_request_schedule_prompt):
  function has no `.await`; dropped the `async` and its `.await` call
  site.
- `needless_pass_by_value` (scheduled_prompts::submit): take
  `&NewSchedule` instead of moving the struct in; updated two prod
  callers and eight test sites to pass references.
- `type_complexity` (approvals::mark_cancelled): hoisted the
  7-tuple SELECT row shape into a `type CancelLookupRow = (…);` alias.

Allow-with-reason for intentional patterns:
- `option_option` (6 sites across dashboard / scheduled_prompts /
  manager_server): `Option<Option<T>>` carries three-state PATCH
  semantics (missing key = leave alone, `Some(None)` = clear,
  `Some(Some(v))` = set). Collapsing to `Option<T>` loses the
  "clear" state.
- `dead_code` (rebuild_queue::QueueKind::Destroy /
  QueueSource::CrashRecover; topology::parent_of / default_seed):
  wire-shape variants + API surfaces kept for the upcoming features
  (#361 follow-ups, future `Destroy` queue routing, crash-recovery
  path). Allowed at the variant / function level with the rationale
  in `reason = "…"`.
- `too_many_lines` on three specific call-sites: a 117-line
  exhaustive-variant test (dashboard_events::kind_tag_matches_…),
  the meta-flake string template renderer
  (meta::render_flake_with_lookup), and the notification poll loop
  (forge_notify::poll_once) — splitting any of them would just hide
  the contiguous shape they exist to keep visible.

`nix flake check` formatting target is still broken on main itself
(pre-existing nixfmt drift across ~28 files unrelated to this PR);
left alone here so the scope stays "crane port + lints the port
exposed" and the operator's review doesn't have to triage drive-by
nixfmt churn.

hive-ag3nt/src/events.rs

@@ -143,10 +143,7 @@ pub enum LiveEvent {
     /// compacting). `since_unix` matches `Bus::state_snapshot().1`
     /// so the client's elapsed-time ticker keeps progressing across
     /// SSE reconnects without drift.
-    TurnStateChanged {
-        state: TurnState,
-        since_unix: i64,
-    },
+    TurnStateChanged { state: TurnState, since_unix: i64 },
 }
 
 /// sqlite-backed event log. Wraps a `Connection` behind a `Mutex` so the
@@ -284,10 +281,12 @@ impl TokenUsage {
         let model_usage = v.get("modelUsage")?;
         let map = model_usage.as_object()?;
         for (_model, stats) in map {
-            if let Some(w) = stats.get("contextWindow").and_then(serde_json::Value::as_u64) {
-                if w > 0 {
-                    return Some(w);
-                }
+            if let Some(w) = stats
+                .get("contextWindow")
+                .and_then(serde_json::Value::as_u64)
+                && w > 0
+            {
+                return Some(w);
             }
         }
         None
@@ -353,18 +352,21 @@ pub fn context_window_tokens(model: &str) -> u64 {
     // Per-model env vars set by `hyperhive.contextWindowTokens` in Nix.
     for (key, val) in std::env::vars() {
         if let Some(suffix) = key.strip_prefix("HIVE_CONTEXT_WINDOW_TOKENS_")
-            && !suffix.is_empty() && m.contains(&suffix.to_ascii_lowercase())
-                && let Ok(v) = val.trim().parse::<u64>()
-                    && v > 0 {
-                        return v;
-                    }
+            && !suffix.is_empty()
+            && m.contains(&suffix.to_ascii_lowercase())
+            && let Ok(v) = val.trim().parse::<u64>()
+            && v > 0
+        {
+            return v;
+        }
     }
     // Global override (single value, any model).
     if let Ok(s) = std::env::var("HIVE_CONTEXT_WINDOW_TOKENS")
         && let Ok(v) = s.trim().parse::<u64>()
-            && v > 0 {
-                return v;
-            }
+        && v > 0
+    {
+        return v;
+    }
     // Hard fallback for dev/test outside NixOS where env vars aren't set.
     200_000
 }
@@ -450,9 +452,10 @@ impl Bus {
         // persisted runtime override > compiled-in DEFAULT_MODEL.
         // The nix config always wins on rebuild; the persisted file is kept
         // for within-session tracking only (see persist_model / set_model).
-        let initial_model = configured_model()
-            .map(str::to_owned)
-            .unwrap_or_else(|| load_model().unwrap_or_else(|| DEFAULT_MODEL.to_owned()));
+        let initial_model = configured_model().map_or_else(
+            || load_model().unwrap_or_else(|| DEFAULT_MODEL.to_owned()),
+            str::to_owned,
+        );
         // Restore rate_limited from the sentinel file — if the harness
         // crashed while parked, we should still show the right status on
         // cold load until the next turn clears it.
@@ -560,7 +563,8 @@ impl Bus {
     pub fn record_turn_usage(&self, ctx: TokenUsage, cost: TokenUsage) {
         *self.last_ctx_usage.lock().unwrap() = Some(ctx);
         *self.last_cost_usage.lock().unwrap() = Some(cost);
-        self.last_turn_ended_unix.store(now_unix(), Ordering::Relaxed);
+        self.last_turn_ended_unix
+            .store(now_unix(), Ordering::Relaxed);
         self.emit(LiveEvent::TokenUsageChanged { ctx, cost });
     }