Stage 0: CI & tooling foundation (fmt/clippy/test/wasm gate)

[EYH0602]

Summary

Implements plans/stage-0-ci-tooling.md.

Adds the reproducible CI gate for the workspace before any product code lands: a
GitHub Actions workflow (fmt, clippy, test, wasm-build) on a pinned,
SHA-locked toolchain and action set, plus supporting config. No product logic;
this stage installs the quality gate every later stage PR runs through.

Plan Steps

• Pin exact toolchain 1.94.1 + rustfmt config (b4e8f68)
• Drop unverified MSRV (rust-version) from workspace + all 4 crates (b4e8f68)
• Bump 0.0.0 → 0.0.1 and regenerate Cargo.lock so --locked stays in sync (b4e8f68)
• CI workflow: on/concurrency/permissions, ubuntu-24.04, --locked builds, SHA-pinned actions (94c70b9)
• wasm job guards both ara-core and ara-wasm (94c70b9)
• Dependabot for cargo + github-actions, weekly (94c70b9)
• CONTRIBUTING.md documenting the CI-mirroring local checks (5f3ac00)
• TODOS.md for deferred work — MSRV job, wasm-target clippy, docs/ (e792e42)

Deferred to a follow-up (documented, not silently dropped):

• Branch-protection ruleset on main requiring the 4 checks (plan step 7 / T8).
  This is a repo setting, and GitHub can only select the check names after CI
  runs once — so it's a post-merge step, done once this PR's CI is green.

Review Status

Eng Review: CLEAR (/plan-eng-review, 8 findings folded, 0 critical gaps).
Outside voice (Codex) ran — surfaced the floating toolchain pin, lockfile/version
sequencing, unenforced gate, and ara-wasm coverage; all folded. See the
## GSTACK REVIEW REPORT in the plan file. Implementation independently
spec-reviewed (all 8 items PASS).

Test Plan

All four CI commands were run locally and pass (they mirror the workflow exactly):

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked
• cargo build -p ara-core -p ara-wasm --target wasm32-unknown-unknown --locked
• Confirm all 4 CI jobs go green on this PR, then enable the main branch-protection ruleset (T8).

[fenfenai]

Review Summary

Reviewed 20 files (+844/-10) across bug detection, guidelines compliance, and test/CI-correctness aspects. This is a config-only stage — no product logic — and it is well-executed: exact toolchain pin (1.94.1), SHA-pinned actions, --locked on every building job, least-privilege permissions: contents: read, and rustfmt using only stable options (max_width, edition) so it won't break on the stable channel. The Cargo.lock regen matches the 0.0.0 → 0.0.1 bump, so --locked stays green. The trivial dependency-free skeleton crates guarantee the fmt/clippy/test/wasm commands pass.

No findings at confidence ≥75 that block merge. Approving.

Minor (non-blocking)

Job name is wasm, but the CHANGELOG and PR body call it wasm-build (confidence: 80). The actual CI job id/name is wasm (.github/workflows/ci.yml:44-45), while CHANGELOG.md and the PR description list the gate as wasm-build. This is cosmetic today, but the deferred branch-protection step (plan step 7 / T8) selects required status checks by their exact job name — configuring protection off the docs would look for a non-existent wasm-build check. Suggest aligning the CHANGELOG/PR wording to wasm (or renaming the job) before T8 is set up.

Positive Observations

• Determinism rationale is captured inline (exact patch pin comment, --locked intent) — the why survives.
• Deferred work (MSRV job, wasm-target clippy, docs/ lifecycle, branch protection) is documented in TODOS.md rather than silently dropped.
• Dependabot correctly covers both cargo and github-actions, so the SHA pins won't rot silently.

[fenfenai]

The CI job is named wasm (.github/workflows/ci.yml:44-45), not wasm-build. Minor, but the deferred branch-protection ruleset (plan T8) requires status checks by exact name, so align this to wasm to avoid selecting a non-existent check later. (confidence: 80)