arghda-core/ has no CI workflow — Rust crate is in-tree but untested

[hyperpolymath]

Surfaced from

#113 (panic-attack Track-C triage). While auditing `arghda-core/src/lint/orphan_module.rs` for the `UnboundedAllocation` finding, I noticed the crate has no CI coverage in this repo.

What's missing

`arghda-core/` is a real Rust crate sitting at the repo root:

• `arghda-core/Cargo.toml` — `name = "arghda-core"`, version 0.1.0, binary `arghda` at `src/main.rs`, real dependencies (`clap`, `notify`, `serde`, `walkdir`), real dev-deps (`tempfile`)
• `arghda-core/src/lint/` — at least one lint module (`orphan_module.rs`, 178 lines)
• `arghda-core/tests/` — test directory exists

But there is no GitHub Actions workflow that runs `cargo build` / `cargo test` / `cargo clippy` against it:

```
$ grep -l 'arghda|cargo' .github/workflows/*.yml
(no output)
```

The `flake.nix` does include Rust tooling in the devShell (`pkgs.rustc pkgs.cargo pkgs.rustfmt pkgs.clippy` at line 69), so the toolchain is available — just nothing invokes it on push.

Why this matters

• `arghda-core` is referenced in CLAUDE.md as a planned hyperpolymath-ecosystem tool ("Lightweight proof-workspace manager for Agda") and is described as one node in the wider ecosystem map. Code that ships under that name should at minimum compile + pass its own tests in CI.
• The `echo-types` repo's CI gate currently certifies Agda `--safe --without-K` + the kernel-guard, but leaves `arghda-core` as untested in-tree code that nonetheless ships with the repo. A future contributor (or me) breaking the crate would land it without CI catching it.
• The repo MAP describes `arghda-core` as a real artefact (`[REAL]` adjacent); CI absence is a gap relative to that classification.

Suggested scope

One of:

1. Minimal: Add `.github/workflows/rust.yml` running `cargo build && cargo test` against `arghda-core/` on push / PR. Reuses the standards Rust-CI reusable if appropriate (`hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@`, see other estate repos that adopted it).
2. Compactified: Extend the existing `Agda` workflow with a `cargo-check` job that lives alongside the Agda jobs.
3. Decline: If `arghda-core/` is going to be extracted to its own repo (per CLAUDE.md "planned" status), the CI gap is intentional. In that case mark the directory as out-of-scope-for-CI in the repo's README and gate against accidental in-tree expansion.

Out of scope

• Refactoring `arghda-core` itself.
• Adding CI for any non-Rust artefact (Agda is already covered).
• Moving `arghda-core/` to its own repo (separate decision).

Refs

• security: 12 Critical/High panic-attack findings need human triage (Track C) #113 (panic-attack Track-C — adjacent finding's audit surface)
• CLAUDE.md §"This repo" — references `arghda-core` as ecosystem-tier tool

🤖 Surfaced during a seam-analyst pass on #113.