ci-requirements: the Rust lane can be checked before pushing, not just after

fmt was already documented here. Operator authorised clippy and test through the
same pinned image on 2026-08-18, so the section now covers the whole pre-push
loop rather than a third of it.

The commands are byte-identical to the workflow's on purpose — a local check that
differs from CI is worse than no local check, because it produces confidence
without coverage. That this is a faithful proxy is not an assumption: the local
test binary hashes matched CI run 3931's exactly (thoughtsync_core-bbaae797…,
thoughtsync_desktop_lib-9d162263…, thoughtsync_ffi-fc557b96…). Same image, same
lockfile, same compilation units.

Also records that target/ persists on the host, which is why the second run costs
~30s rather than several minutes, and that it is gitignored and disposable.

Scope note in the text: this authorises fmt/clippy/test only. Not the bundle
build, not a local stack.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -189,25 +189,43 @@ reason. Bump the three together or not at all.
 
 No workflow consumes it yet; the lane arrives with the app skeleton (M12 step 5).
 
-## Formatting the Rust lane before pushing
+## Checking the Rust lane before pushing
 
-`cargo fmt --check` runs in CI and had failed on four consecutive desktop pushes
-by itself, each costing a full cycle to learn a whitespace nit. There is no Rust
-toolchain on the workstation (rule 10), but the CI image is pullable, and running
-a formatter is neither a test run nor a local stack:
+There is no Rust toolchain on the workstation (rule 10) and the desktop lane is
+verified entirely in CI — but the CI image is pullable, so the three analyzer
+steps can be run against it locally first. **The operator authorised this on
+2026-08-18** for `fmt`, `clippy` and `test`; it is not licence to run the bundle
+build or stand up anything.
+
+Run all three, in this order, before any push that touches Rust:
 
 ```
-docker run --rm --user "$(id -u):$(id -g)" -e CARGO_HOME=/tmp/cargo \
-  -v "$PWD:/w" -w /w \
-  git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo fmt --all --check
+IMG=git.fabledsword.com/bvandeusen/ci-tauri:1.97
+DOCK="docker run --rm --user $(id -u):$(id -g) -e CARGO_HOME=/tmp/cargo -v $PWD:/w -w /w"
+
+$DOCK $IMG cargo fmt --all --check
+$DOCK $IMG cargo clippy --locked --workspace --all-targets -- -D warnings
+$DOCK $IMG cargo test --locked --workspace
 ```
 
-Drop `--check` to apply. `--user` keeps the container from leaving root-owned
-files behind; `CARGO_HOME` points somewhere writable for that user.
+Drop `--check` from the first to apply it. `--user` keeps the container from
+leaving root-owned files behind; `CARGO_HOME` points somewhere writable for that
+user. Commands are IDENTICAL to the workflow's, deliberately — a local check that
+differs from CI is worse than none.
+
+**This reproduces CI exactly, not approximately.** On the 2026-08-18 run the
+local test binary hashes (`thoughtsync_core-bbaae79723888ad1`,
+`thoughtsync_desktop_lib-9d162263f8d0aca3`, `thoughtsync_ffi-fc557b96dc795e27`)
+matched CI run 3931's byte for byte. Same image, same lockfile, same units.
+
+`target/` persists on the host between runs, so after the first cold build these
+take seconds (~30s for clippy). It is gitignored and reaches ~1.4 GB; delete it
+whenever the space is wanted.
 
 **Don't infer formatting from existing code.** Several lines in `local/store.rs`
 exceed 100 characters and survive only because rustfmt cannot break a string
-literal — copying that shape caused one of the four failures.
+literal — copying that shape caused one of four consecutive fmt-only CI failures,
+which is what this whole section exists to prevent.
 
 ## The desktop lockfile