CI: four Rust checks red once the toolchain step starts again — rustls RUSTSEC-2026-0285, clippy must_use, missing cargo-llvm-cov

[hyperpolymath]

These checks never reported on main @ b312f57 because the Rust setup step died first (dtolnay/rust-toolchain@stable lock pin mismatch). Dependabot PR #294 re-pins it (d0c8d84, gh actions-lock --accept-moved), so the jobs now run, and they fail on defects already in the tree. None of them is caused by the actions bump.

check	failure	cure
cargo audit	RUSTSEC-2026-0285 rustls 0.23.37 (TLS 1.3 handshake across encryption levels; patched >=0.23.45). Also warns RUSTSEC-2026-0253 lru 0.16.4 unsound (patched >=0.18.2).	cargo update -p rustls (and lru if the semver range allows)
cargo deny	same RUSTSEC-2026-0285	same
clippy (all-targets)	7 × this function has a #[must_use] attribute with no message, but returns a type already considered as #[must_use] in verisim-provenance	drop the redundant #[must_use] attributes
cargo-llvm-cov (≥60%)	error: no such command: llvm-cov	install cargo-llvm-cov in the job (pinned action or cargo install --locked)

Also seen: the cargo-audit action logs Unable to publish audit check! … Resource not accessible by integration because the job lacks checks: write. This doesn't change the verdict.

Acceptance criteria

• Cargo.lock resolves rustls >= 0.23.45; cargo audit and cargo deny green on main.
• clippy (all-targets) green on main with no new allow.
• cargo-llvm-cov (≥60%) runs and reports coverage on main (green, or red only on the threshold itself).

🤖 Generated with Claude Code