chore: add full-treatment quality gates

Mirrors the ucobs convention:
- justfile aggregates test-{unit,clippy,fmt,doc,deny,fuzz,miri,mutants}
  behind a single 'just test' target.
- mise.toml pins rust + cargo-{deny,fuzz,mutants,nextest}.
- deny.toml enforces permissive licenses only and bans wildcard /
  unknown-source deps.
- CLAUDE.md captures identity and first principles.
- Cargo.toml adds unsafe_code = forbid and docs.rs all-features metadata.

cargo check (all feature permutations), nextest, clippy with warnings
as errors, fmt check, doc, and deny all pass. fuzz/miri/mutants land
in follow-up commits.

Cargo.toml

@@ -29,6 +29,12 @@ std = []
 [dev-dependencies]
 proptest = "1"
 
+[package.metadata.docs.rs]
+all-features = true
+
+[lints.rust]
+unsafe_code = "forbid"
+
 [lints.clippy]
 unwrap_used = "deny"
 expect_used = "deny"

deny.toml

@@ -0,0 +1,31 @@
+[graph]
+all-features = true
+
+[advisories]
+yanked = "deny"
+
+[licenses]
+# Permissive licenses only. All copyleft (GPL, LGPL, AGPL, MPL, etc.) denied by omission.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unlicense",
+    "CC0-1.0",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+]
+unused-allowed-license = "allow"
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

justfile

@@ -0,0 +1,69 @@
+# donglora-protocol development tasks
+
+# default: list all recipes
+default:
+    @just --list
+
+# run ALL quality gates (tests, clippy, fmt, doc, deny, fuzz, miri, mutants)
+test: test-unit test-clippy test-fmt test-doc test-deny test-fuzz test-miri test-mutants
+
+# quick compile check (all feature permutations)
+check:
+    cargo check
+    cargo check --no-default-features
+    cargo check --all-features
+
+# unit + proptest + doc tests
+test-unit:
+    cargo nextest run
+    cargo nextest run --no-default-features
+    cargo nextest run --all-features
+    cargo test --doc
+
+# clippy with warnings as errors across feature permutations
+test-clippy:
+    cargo clippy --all-targets -- -D warnings
+    cargo clippy --all-targets --no-default-features -- -D warnings
+    cargo clippy --all-targets --all-features -- -D warnings
+
+# check formatting
+test-fmt:
+    cargo fmt -- --check
+
+# doc build (catches broken doc links)
+test-doc:
+    cargo doc --no-deps --all-features
+
+# license and advisory audit
+test-deny:
+    cargo deny check
+
+# fuzz every target for 60s (requires nightly + cargo-fuzz)
+test-fuzz:
+    cd fuzz && cargo +nightly fuzz run parse_command -- -max_total_time=60
+    cd fuzz && cargo +nightly fuzz run parse_radio_config -- -max_total_time=60
+    cd fuzz && cargo +nightly fuzz run cobs_decoder_feed -- -max_total_time=60
+    cd fuzz && cargo +nightly fuzz run cobs_roundtrip -- -max_total_time=60
+
+# run tests under miri (catches UB, requires nightly + miri component)
+# proptest is skipped — its file-persistence layer calls getcwd which miri does not support
+test-miri:
+    cargo +nightly miri nextest run --lib
+    cargo +nightly miri nextest run --lib --no-default-features
+
+# mutation testing (requires cargo-mutants)
+test-mutants:
+    cargo mutants --no-shuffle
+
+# format code
+fmt:
+    cargo fmt
+
+# build in release mode
+build:
+    cargo build --release
+
+# clean all build artifacts
+clean:
+    cargo clean
+    rm -rf fuzz/target fuzz/corpus fuzz/artifacts

mise.toml

@@ -0,0 +1,6 @@
+[tools]
+rust = "1.94"
+"cargo:cargo-deny" = "latest"
+"cargo:cargo-fuzz" = "latest"
+"cargo:cargo-mutants" = "latest"
+"cargo:cargo-nextest" = "latest"