feat(ci): adopt canonical Rust+Python CI gates (zackees/zccache#835)

[zackees]

Summary

Applies the full ruleset from zackees/zccache#835 to the canonical hybrid Rust+Python template so every future gh repo create --template zackees/template-python-rust-cmd consumer inherits the practices by construction. This is the template-first leg of the rollout — backfilling existing repos (zackees/clud, zackees/soldr, zackees/running-process, etc.) comes next, but the template fix is the multiplier.

What landed

• ci.sh + ci.py PEP 723 dispatcher. Thin bash wrapper + Python script with inline deps. Loads uv run --no-project --script exactly once so every gate avoids the maturin auto-build trap (a bare uv run on a maturin-backed pyproject.toml triggers a full wheel build before the script starts; the flags suppress that).
• ci/gates/{loc,fmt,clippy,ruff,build,test,action_yaml,action_surface}.py. One file per gate, each exposing def run() -> int. Canonical ordering owned by ci.py::GATE_ORDER. build is the only fatal gate — see rule 7.
• ci/hooks/{tool_guard,readme_guard,loc_guard,check-on-start}.py. tool_guard extended per rule 4 to ban uv run without --no-project --script outside named build entry points (./test, ./build, ci/build_wheel.py, etc.). readme_guard enforces the 50-line floor per rule 8.
• .github/workflows/ci.yml rewritten as thin orchestration. 8-platform matrix (linux-x86, linux-x86-musl, linux-arm, linux-arm-musl, mac-x86, mac-arm, windows-x86, windows-arm), every step is ./ci.sh <gate>, continue-on-error: true everywhere except build, final report-failures step collects step outcomes.
• .claude/settings.json binds all four hooks to PreToolUse / PostToolUse / SessionStart events.
• action.yml + action/cleanup/action.yml make the repo a real composite action. Both validated by action_yaml (structural) + action_surface (subcommand-vs-binary surface match).
• tests/test_gates.py locks the def run() -> int contract across all 8 gates — 32 parametrized cases.
• READMEs added/expanded to ≥ 50 lines for every directory in the tree per the readme_guard floor (.cargo/, .claude/, .github/, .github/workflows/, action/, action/cleanup/, ci/, ci/gates/, ci/hooks/, crates/, crates/template-{core,cli,py}/, docs/, src/, src/template_python_rust_cmd/, tests/).
• Hygiene. .gitignore extended for Python build artifacts; built _native*.pyd and dist/* untracked.

Rule-by-rule mapping

Rule	Where it landed
1. LOC budget as a gate	ci/gates/loc.py
2. Linters must NOT trigger a full build	ci.sh / ci.py
3. Single bash wrapper for the dispatcher	ci.sh
4. Ban unsafe uv run shape via hook	ci/hooks/tool_guard.py
5. Reserve full uv run for explicit build entry points	BUILD_ENTRY_POINTS in tool_guard.py
6. ci.yml is thin orchestration	.github/workflows/ci.yml
7. One runner per platform; continue-past-failure with build fatal	ci.yml matrix + report-failures step
8. README guard with 50-line floor	ci/hooks/readme_guard.py
9. Hooks vs gates split	ci/gates/ vs ci/hooks/
10. Action.yml self-test is cheap, not full re-build	ci/gates/action_yaml.py, ci/gates/action_surface.py

Local validation

./ci.sh --list                 # lists 8 gates
./ci.sh loc                    # PASS
./ci.sh fmt                    # PASS
./ci.sh ruff                   # PASS (after auto-format)
./ci.sh build                  # PASS (cargo check workspace)
./ci.sh action_yaml            # PASS
uv run pytest tests/test_gates.py   # 32 passed

tool_guard hook self-tests:

• bare cargo build → DENY (exit 2, structured permission decision payload)
• ./ci.sh fmt → PASS
• ./test → PASS (named build entry)
• uv run --no-project --script ci/build_wheel.py → PASS

Test plan

• CI matrix completes on all 8 platforms (this PR is the first run that exercises the full matrix).
• action_yaml gate passes against the new action.yml + action/cleanup/action.yml.
• action_surface gate passes — verifies template-cli --help covers everything action.yml shells out to.
• tests/test_gates.py passes (32 cases).
• Verify gh repo create --template zackees/template-python-rust-cmd ... inherits all the above intact.

Notes

• The two existing ci/lint.py and ci/test.py shims were removed; ./lint and ./test now route directly through ./ci.sh.
• ci/build_wheel.py and ci/publish.py kept as-is — they're the documented opt-in to the full maturin context (per rule 5).
• This template currently has placeholder Rust crates; the composite action's smoke test will work end-to-end only once the package is published. The gates themselves don't require the package on PyPI.

🤖 Generated with Claude Code