feat(#3245): gate rustdoc in nix flake check, and clear the workspace

Nothing in the gate read doc-comments: clippy doesn't check intra-doc
links, cargo test doesn't, and no check built docs. So a [`Foo`] pointing
at a renamed, moved or deleted item rendered as plain text and had no
discoverer but a human happening to read the comment.

That matters here more than in most repos, because the convention is to
put a thing's authoritative description in one doc-comment and point at
it from everywhere else -- the design leans on the pointers being real,
and a dangling link is worse than no link since it names something and
sends the reader looking.

Adds `docs-rustdoc` to nix/checks.nix: craneLib.cargoDoc over
--workspace --no-deps --document-private-items, denying six rustdoc
lints. Listed explicitly rather than -D warnings so a new lint appearing
upstream cannot red the build on a class nobody has triaged.

--document-private-items is load-bearing rather than thoroughness for
its own sake: most of this workspace's doc-comments live on private
items and //! module headers, so without it rustdoc checks a small
fraction of the links and the gate sits green while the rot continues.

Then fixes every error it reports, 40 to 0 across nine crates. The
classes differ and so do the fixes:

- public item, wrong scope -> qualify. Node and Node::parent are both
  public; the link failed only because scheduler.rs does not import
  Node. Six sites become [`crate::Node::parent`].
- private item -> downgrade to backticks. Nothing was made public to
  satisfy a lint; changing API surface to appease a doc check would be
  the tail wagging the dog.
- genuinely dead -> [`JobBuilder::insert_into`] names a method that does
  not exist. Insertion is Scheduler::insert_job.
- prose that looks like markup -> argv[0] parsed as a link, and
  <args>/<hex>/<name> parsed as HTML tags.

Note for future fixes: pub(crate) resolves in an intra-doc link, a plain
private fn in a binary crate does not (wait_for_nodes resolved,
connect_hint did not, same crate, same shape).

The check does not ride the clippy/test artifact cache. It takes
cargoArtifacts, but rustdoc needs its own flavour of dependency
metadata, which cargo build does not produce, so a --no-deps docs build
still compiles dependencies it never documents. Measured at 6m47s cold;
that reasoning is recorded in the check's own comment so the next reader
does not re-derive it.

Verified by running the check's exact command against the pre-cleanup
tree first: 40 errors, build failed. A gate that cannot fail is not
evidence, and building it before the cleanup makes that proof free.

hive-matrix-mcp/src/accounts.rs

@@ -50,7 +50,7 @@ impl AccountCfg {
     /// daemon-wide `HIVE_MATRIX_URL` — or `None` when neither is set.
     ///
     /// `None` is a real answer, not a failure: the account is skipped, the
-    /// same way [`discover_token_accounts_in`] already skips a discovered
+    /// same way `discover_token_accounts_in` already skips a discovered
     /// token whose homeserver sidecar is missing.
     #[must_use]
     pub fn homeserver(&self) -> Option<String> {

hive-matrix-mcp/src/handlers.rs

@@ -178,7 +178,7 @@ pub fn room_label(room: &matrix_sdk::Room) -> String {
 /// content (the agent must `read_room` then `mark_read` the latest event
 /// first), or `None` when the send may proceed.
 ///
-/// Read-state is [`room_unread_state`] — the same predicate the wake path
+/// Read-state is `room_unread_state` — the same predicate the wake path
 /// and `get_loose_ends` use, so "caught up" here means exactly what those
 /// surfaces mean. Reactions and `mark_read` are not gated — only
 /// message-posting tools (`send_message`, `send_reply`, `send_dm`) so an
@@ -195,7 +195,7 @@ async fn unread_guard(client: &Client, room: &matrix_sdk::Room) -> Option<Daemon
 
 /// Fetch the single most recent timeline event in `room`, of any type
 /// (redactions/state/reactions included — identity is what
-/// [`room_unread_state`] needs, not content). `None` for a genuinely
+/// `room_unread_state` needs, not content). `None` for a genuinely
 /// empty room or on any request failure.
 async fn latest_event(
     client: &Client,
@@ -909,7 +909,7 @@ pub async fn download_file(
 ///
 /// **Latency note**: each unread room triggers a live `/messages`
 /// network request to the matrix homeserver to determine its latest
-/// event (via [`room_unread_state`]). This adds per-room round-trip
+/// event (via `room_unread_state`). This adds per-room round-trip
 /// latency to `get_loose_ends` and the wake-signal path. Acceptable in
 /// practice (rooms with unread are few; request is best-effort), but
 /// worth bearing in mind if latency becomes a concern.

hive-matrix-mcp/src/mcp.rs

@@ -550,7 +550,7 @@ async fn unread_summary_handler(
 /// Run the MCP server over HTTP (rmcp streamable-http transport) on
 /// `addr`, dispatching against `registry`. Also serves a small
 /// non-MCP `/unread-summary` status endpoint (see
-/// [`unread_summary_handler`]).
+/// `unread_summary_handler`).
 ///
 /// Sole transport — there is no stdio mode. Long-lived so claude
 /// reconnects to the stable URL each turn instead of respawning a

hive-matrix-mcp/src/wake.rs

@@ -20,7 +20,7 @@ use hive_sock_client::{Retry, notify};
 const TODO_SOCKET_RETRY: Retry = Retry::None;
 
 /// The harness-served in-agent socket (`HIVE_AGENT_SOCKET`) where todo ops
-/// go — distinct from the host-served control socket used by [`send_wake`].
+/// go — distinct from the host-served control socket used by `send_wake`.
 /// `None` when unset/empty, in which case todo sends are a best-effort
 /// no-op (a standalone daemon without the harness socket).
 fn agent_socket() -> Option<std::path::PathBuf> {