chore(lint): enforce proof minting with clippy disallowed-methods, replacing the grep in check-deps.sh

Start with clippy.toml, the proof-minting section of scripts/check-deps.sh, and the documented mint sites in crates/thrust-ports/src/lib.rs and crates/thrust-core/src/lib.rs. Check whether disallowed-methods catches aliases and function values, then run the clippy command in the acceptance criteria and verify each specified control fails as expected. Done means the lint and any needed residual guard cover the mint paths, the outdated comments and docs are corrected, and all targets pass clippy.

Context

Scope, WorkspaceScope and SystemScope (crates/thrust-ports/src/lib.rs:115, :143, :170) are the proofs that a user may act in a workspace and project, that they are an active member of a workspace, and that a caller may do the untenanted operations. Their fields are private, but their constructors, mint, are pub #[doc(hidden)] (:124, :152, :177), because core, the adapters and the two composition roots are different crates. So nothing in the type system stops any crate from forging a proof. What stops it is scripts/check-deps.sh, in the "proof minting" section (:103-134): an awk pass over crates/thrust-core/src/lib.rs that tracks which fn each call is in, and a grep over crates/ for (Scope|SystemScope|WorkspaceScope)::mint(. It allows Scope::mint only in authorize_with_role, WorkspaceScope::mint only in authorize_workspace, and SystemScope::mint only in the three composition-root files, and it exempts crates/*/tests/ and core's unit-test module.

ADR-0045 (.agents/plans/contrail/adrs/data/interfaces/0045-repository-and-unit-of-work-ports.md:133) decided that "Clippy's disallowed-methods replaces the grep once the clippy job exists (#40)". #40 is closed (#87): the lint job runs clippy with -D warnings. disallowed-methods is not configured, and the script says so (check-deps.sh:106).

Legitimate call sites on main today (a206319):

Problem

The grep is a text match, so it passes anything that does not spell the call the way it expects. I tried each form on a one-line input with the script's own pattern (this was a test of the pattern, not a planted failing run of the script):

Each of the three that pass forges a proof and leaves check-deps.sh green. (The comment at check-deps.sh:104-106 says a qualified path is not caught; by this test a fully qualified call is, and the real gaps are the three above. That comment is wrong and should be corrected.) The awk half also decides "which function" by matching fn <name> in the text, which is a heuristic.

A lint resolves the call to the function it names, so it does not depend on how the call is spelled. That is the reason ADR-0045 chose it.

Proposal

• In the root clippy.toml, disallowed-methods with thrust_ports::Scope::mint, thrust_ports::WorkspaceScope::mint and thrust_ports::SystemScope::mint, each with a reason that names its owner.
• Put #[allow(clippy::disallowed_methods, reason = "...")] on the five legitimate sites and the core test helper. For the 19 test files, first find out whether this lint has a tests exemption like the four panic lints' allow-*-in-tests. I don't know that it does. If it does not, each file needs the allow, as 21 test files needed one for those lints in #87. Of the 19 files that mint, 12 already carry that #![allow(..)] and could share it, and tests/model/mod.rs is covered by its parent (pg_adapter.rs). The other six do not: thrust-core/tests/projects.rs and five in thrust-compat-plane (a crate outside the seven that have the panic lints, so those files have no such allow yet).
• Open question: does disallowed-methods also flag mint used as a function value (let f = SystemScope::mint;), as opposed to called? Test it. If it does not, keep a small residual grep for ::mint without the parenthesis.
• Decide what stops someone adding an #[allow(clippy::disallowed_methods)] where it does not belong. Today the exemption list is in a script that a reviewer reads; after this it would be an attribute that can be added anywhere. A short grep that fails on that attribute outside the known files, or a code-owner rule, would keep the guarantee.
• Then remove the "proof minting" section of check-deps.sh (or reduce it to that residual guard), and update the three doc comments that cite it (crates/thrust-ports/src/lib.rs:113, :141, :168).

A structural alternative exists: a witness type that only core can construct, so a proof cannot be forged and no lint is needed. It is a bigger change and ADR-0045 chose the lint, so it is noted here and not proposed.

Acceptance criteria

• disallowed-methods is configured and cargo clippy --workspace --all-targets -- -D warnings passes on main.
• The controls, each shown failing (AGENTS.md rule 8): a Scope::mint call in non-test thrust-api code fails clippy; and each of the three forms the grep misses (alias, function value, <Scope>::mint() fails clippy, or, where it does not, a residual check covers it and the gap is written down.
• The "proof minting" section of check-deps.sh is removed or reduced to the residual guard, and the three doc comments in thrust-ports no longer name a script that does not check it.
• Every non-test mint site outside the five above is gone or annotated with its reason, and the test sites carry the allow.
• The docs that describe this check say what is true after the change: docs/src/testing/techniques/architecture-gates.md and docs/src/contributing/standards.md.

Docs that state this wrongly today

• docs/src/testing/techniques/architecture-gates.md:59-60 (the "Target" section, added in #87) says clippy's disallowed-methods and disallowed-types "are the complete check for what check-deps.sh does with grep", in a sentence about R-P1 (no platform SDK outside adapters). Those are two different controls. The grep is the proof-minting check described here. R-P1 is the crate-graph rule that cargo tree enforces. That sentence conflates them and should be corrected by this work, or sooner.
• docs/src/testing/defect-matrix.md row X10 (also from #87) suggests clippy disallowed-types for R-P1. That is a separate idea, untested, and not part of this issue.

References

#35 and #44 (the proof types), #40 and #87 (the clippy job); ADR-0045 line 133; scripts/check-deps.sh:103-134; crates/thrust-ports/src/lib.rs; crates/thrust-core/src/lib.rs; clippy.toml; AGENTS.md rules 8 and 9.