ci: restore green pipeline and harden CI workflow

[guyghost]

Summary

The last main push ("test: expand unit coverage…") broke CI: cargo fmt --check failed across the newly added test modules, so the pipeline never reached clippy/tests. This PR restores a green pipeline and improves the workflow itself.

What changed

1. Fix the broken pipeline (fix: format tests and resolve clippy lints)

• cargo fmt applied to test modules in adapters/, config/, core/, event/, state/ — pure reformatting, no behavior change.
• Fixed clippy::field_reassign_with_default in state::persistence tests (struct initializer instead of post-Default reassignment).
• Fixed clippy::useless_format in adapters::codex test (format!(r#"..."#) → raw string .to_string()).

bash scripts/dev.sh ci is now green locally: 1644 tests pass, 0 failures (incl. doctests).

2. Improve the CI workflow (ci: harden workflow and add macOS build gate)

Improvement	Why
concurrency with cancel-in-progress on PRs	Stops stale runs, frees CI minutes
permissions: contents: read	Least-privilege token
workflow_dispatch	Manual re-runs
Per-job timeout-minutes + RUST_BACKTRACE=1 + color	Avoid hung jobs, better diagnostics
cargo fetch --locked gate	Catch Cargo.lock drift before build
New build-macos job (cargo build --locked --all-targets)	Lint/test run on Linux but the project targets macOS (notify macos_fsevent, arboard) — this catches cross-platform compile breakage

The primary check job still runs bash scripts/dev.sh ci, preserving the local == CI invariant the tooling is built around.

Verification

• bash scripts/dev.sh ci green locally (fmt, clippy -D warnings, all tests)
• Workflow YAML validated (structure + triggers + jobs)
• CI green on this PR (both check and build-macos jobs)

[Copilot]

Pull request overview

Restores CI stability after a formatting-related break on main and strengthens the CI workflow so it’s both more reliable and more representative of local development checks (bash scripts/dev.sh ci), while adding a macOS compilation gate for cross-platform safety.

Changes:

• Reformats multiple test modules to satisfy cargo fmt --check and unblock the pipeline.
• Fixes a couple of Clippy warnings in tests (struct init instead of post-Default field reassignment; removes a format! that was only wrapping a raw string).
• Hardens .github/workflows/ci.yml with concurrency cancellation on PRs, least-privilege permissions, timeouts, lockfile fetch gate, and a macOS build job.

Reviewed changes

Copilot reviewed 5 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/state/persistence.rs	Test cleanup: fixes clippy lint (field_reassign_with_default) and applies formatting.
src/event/dispatcher.rs	Test formatting only.
src/core/models/state_machine.rs	Test formatting only.
src/core/models/git.rs	Test formatting; minor formatting compaction in commit constructor call.
src/core/logic/guards.rs	Test formatting only.
src/config/saver.rs	Test import ordering + formatting.
src/config/loader.rs	Test formatting only.
src/adapters/cursor.rs	Test formatting only.
src/adapters/codex.rs	Test formatting; replaces format!(r#"..."#) with raw string .to_string(); minor formatting of async write.
src/adapters/claudecode.rs	Test formatting only.
.github/workflows/ci.yml	Adds permissions/concurrency/env/timeouts, lockfile fetch gate, workflow_dispatch trigger, and new macOS build gate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.