style: clear clippy warning backlog for the clippy CI job (#193)

[dobby-coder]

Closes #193 — CI: add cargo clippy lint job to build.yml.

What this PR does

Adds a clippy job to .github/workflows/build.yml and clears the clippy
warning backlog across the workspace so the job passes under -D warnings
from day one.

Originally this PR shipped only the pushable half (the backlog cleanup),
because the dobby-coder GitHub App lacks the workflows: write permission
and the remote rejects any App push touching .github/workflows/*.yml. The
workflow job has now been added directly by a maintainer, so both halves land
together.

The clippy job

Placed alongside format: in build.yml:

  clippy:
    name: Clippy workspace
    strategy:
      matrix:
        workspace: [core, pkg, cli, ffi]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - if: ${{ matrix.workspace == 'core' }}
        run: cargo clippy --manifest-path pg-core/Cargo.toml --all-targets --features test,rust,stream -- -D warnings
      - if: ${{ matrix.workspace != 'core' }}
        run: cargo clippy --manifest-path pg-${{ matrix.workspace }}/Cargo.toml --all-targets --all-features -- -D warnings

Note vs. the issue's draft: pg-core uses the same test,rust,stream feature
set as the test: job rather than --all-features (its features are mutually
constraining). Because the backlog below is cleared, the job goes straight to
-D warnings — no warn-only interim step needed. (CI's stable clippy may
differ from the local 1.96.1 used here and surface new lints later; if that
happens, the warn-only fallback from the issue still applies.)

Backlog cleanup

Cleared every clippy warning across the four linted crates. All changes are
semantics-preserving:

• needless borrows removed — &x immediately dereferenced, including
  .chain(&counter.to_be_bytes()) → .chain(counter.to_be_bytes()) in the
  stream signing/verification paths (pg-core)
• dropped redundant pub(self), unused test imports (App, HttpResponse),
  and .clone() on the Copy type SecretKey (pg-core, pg-pkg)
• moved gg_read_key_pair above the #[cfg(test)] module (items-after-test,
  pg-pkg)
• Box::from_raw(ptr::slice_from_raw_parts_mut(..)) instead of casting a
  &mut [u8] — avoids materialising an intermediate reference (pg-ffi)
• added # Safety doc sections to the exported pg_seal / pg_free unsafe
  functions (pg-ffi)

Verification

• cargo clippy --all-targets ... -- -D warnings — clean on all 4 manifests
• cargo test — core (test,rust,stream), pkg (43), cli (7), ffi (1) all pass
• cargo fmt --all -- --check — clean
• cargo build --profile edge --bin pg-pkg — compiles (Docker Rust 1.90 parity)

[dobby-coder]

✅ Rules Dobby 2 sign-off — no findings (approve).

Verdict is APPROVE — posted as COMMENT only because GitHub blocks approving your own PR (dobby-coder[bot] authored this). Treat as a clean sign-off.

Reviewed the full diff plus Review Dobby 2's report (0 findings, tests green). This is a pure clippy-backlog cleanup (#193) — every change is semantics-preserving:

• needless-borrow removals in tests (&pk→pk, &usk→usk, &pub_sign_key→pub_sign_key) — target fns take the same effective type.
• pub(self) → private on stream_mode_checked (redundant visibility).
• stream sign/verify .chain(&counter.to_be_bytes())→.chain(counter.to_be_bytes()) / .chain(&[0x00])→.chain([0x00]) — chain takes impl AsRef<[u8]>; byte-identical signing input, no crypto behaviour change.
• pg-ffi: added # Safety docs (missing_safety_doc) and slice::from_raw_parts_mut→std::ptr::slice_from_raw_parts_mut — avoids materialising an intermediate reference to the raw buffer, strictly safer.
• pg-pkg: Data::new(ibe_sk.clone())→Data::new(ibe_sk) (redundant_clone; compiles ⇒ genuine last use) and dropped unused App, HttpResponse test imports.
• pg-pkg/util.rs: gg_read_key_pair relocated above the tests module (pure move).

cargo clippy --all-targets -- -D warnings, cargo fmt --check, and the full test suite all pass. Flipping to ready-for-review.