ci: add GitHub Actions workflows with semantic-release auto-versioning

chore: fix all 702 clippy warnings across codebase
- auto-fix 475 via cargo clippy --fix
- fix remaining 227 manually: uninlined_format_args, redundant_closure, match_same_arms,
  underscore_binding, format_push_string, items_after_statements, needless_pass_by_value,
  clone_on_copy, case_sensitive_extension, single_match/let-else, write_with_newline,
  and other clippy lints

src/app/bgbash/control.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::cast_possible_truncation, clippy::cast_sign_loss, clippy::cast_precision_loss, clippy::cast_possible_wrap)]
 //! Global registry of running background bash jobs, and control operations
 //! (output polling, kill) exposed to the rest of the app.
 //!
@@ -57,7 +58,7 @@ pub fn bash_output(id: &str) -> Option<Vec<String>> {
 /// Return: `Ok(())` on success, `Err` if the lock is poisoned or no job
 /// with that id exists.
 pub fn bash_kill(id: &str) -> anyhow::Result<()> {
-    let mut map = bash_jobs_map().lock().map_err(|e| anyhow::anyhow!("lock error: {}", e))?;
+    let mut map = bash_jobs_map().lock().map_err(|e| anyhow::anyhow!("lock error: {e}"))?;
     let job = map.remove(id);
     match job {
         Some(job) => {
@@ -70,6 +71,6 @@ pub fn bash_kill(id: &str) -> anyhow::Result<()> {
             }
             Ok(())
         }
-        None => anyhow::bail!("bash job '{}' not found", id),
+        None => anyhow::bail!("bash job '{id}' not found"),
     }
 }

src/app/bgbash/job.rs

@@ -17,7 +17,7 @@ use std::io::BufRead;
 
 /// Maximum number of output lines buffered in memory per background job.
 /// Beyond this limit, old output is dropped to prevent OOM (CWE-770).
-/// 10_000 lines at ~100 bytes each ≈ 1 MiB per job, sufficient for most
+/// `10_000` lines at ~100 bytes each ≈ 1 MiB per job, sufficient for most
 /// command output. The stderr drain thread also uses the same limit.
 const MAX_OUTPUT_LINES: usize = 10_000;
 
@@ -52,7 +52,7 @@ pub fn spawn_bash_job(command: String) -> BashJob {
     let id = uuid::Uuid::new_v4().to_string();
     let (output_tx, output_rx) = mpsc::sync_channel::<String>(MAX_OUTPUT_LINES);
     let (pid_tx, pid_rx) = mpsc::channel::<u32>();
-    let cmd = command.clone();
+    let cmd = command;
     let id_for_log = id.clone();
     let thread_id = id.clone();
 
@@ -66,12 +66,12 @@ pub fn spawn_bash_job(command: String) -> BashJob {
         let output_tx = output_tx.clone();
         let pid_tx = pid_tx.clone();
         let id_for_log = id_for_log.clone();
-        move || spawn_bash_thread_body(cmd, output_tx, pid_tx, id_for_log)
+        move || spawn_bash_thread_body(&cmd, &output_tx, &pid_tx, &id_for_log)
     }).is_err()
     {
         tracing::warn!("[bgbash:{}] failed to spawn named thread, using unnamed fallback", id_for_log);
         thread::spawn(move || {
-            spawn_bash_thread_body(cmd, output_tx, pid_tx, id_for_log)
+            spawn_bash_thread_body(&cmd, &output_tx, &pid_tx, &id_for_log);
         });
     }
 
@@ -89,21 +89,21 @@ pub fn spawn_bash_job(command: String) -> BashJob {
 /// spawned from both the named Builder and the unnamed fallback without
 /// double-moving the closure.
 fn spawn_bash_thread_body(
-    cmd: String,
-    output_tx: std::sync::mpsc::SyncSender<String>,
-    pid_tx: std::sync::mpsc::Sender<u32>,
-    id_for_log: String,
+    cmd: &str,
+    output_tx: &std::sync::mpsc::SyncSender<String>,
+    pid_tx: &std::sync::mpsc::Sender<u32>,
+    id_for_log: &str,
 ) {
     let mut child = match Command::new("sh")
         .arg("-c")
-        .arg(&cmd)
+        .arg(cmd)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .spawn()
     {
         Ok(c) => c,
         Err(e) => {
-            let _ = output_tx.try_send(format!("__error:{}", e));
+            let _ = output_tx.try_send(format!("__error:{e}"));
             let _ = output_tx.try_send("__exit:-1".to_string());
             return;
         }
@@ -124,7 +124,7 @@ fn spawn_bash_thread_body(
         std::thread::spawn(move || {
             let reader = std::io::BufReader::new(stderr);
             for line in reader.lines().map_while(Result::ok) {
-                if stderr_tx.try_send(format!("[stderr] {}", line)).is_err() {
+                if stderr_tx.try_send(format!("[stderr] {line}")).is_err() {
                     tracing::debug!("[bgbash] stderr buffer full, discarding remaining stderr");
                     break;
                 }
@@ -153,7 +153,7 @@ fn spawn_bash_thread_body(
 impl BashJob {
     /// Non-blocking poll for the next output line from the job's channel.
     ///
-    /// Flow: try_recv the channel → if it's an `__exit:<code>` sentinel,
+    /// Flow: `try_recv` the channel → if it's an `__exit:<code>` sentinel,
     /// record `exit_code` and return `None` instead of surfacing it as
     /// output → otherwise return the line.
     ///