feat(lint): gate CI on duplicate Rust logic and deduplicate the tree

[zancas]

What this does

This PR adds a CI gate that fails when new duplicate Rust logic enters the tree, and deduplicates every existing finding first so the gate lands at zero-tolerance thresholds with an empty ignore list.

The gate

The workbench bin check-code-duplication runs cargo-dupes' AST-normalizing analyzer (mpecan/cargo-dupes, published as dupes-core/dupes-rust, pinned =0.2.1 in the workbench lockfile) over three scopes: packages/ (excluding the generated zaino-proto tonic output and in-crate tests/ module directories), live-tests/, and tools/. Identifiers normalize to positional placeholders and literals are erased, so a renamed copy of a function still matches. Any exact or near duplicate group of at least 50 AST nodes fails the build. The floor of 50 was calibrated empirically against this tree: it is the level at which every reported group was a genuine dedup-worthy twin, while lower settings flag structurally-rhyming but semantically unrelated small functions. The calibration rationale and the escape hatch (annotated entries in .dupes-ignore.toml, created via code-dupes ignore <fingerprint> --reason "...") are documented in the bin's module docs.

The gate runs locally as lint-code-duplication under makers lint, and in CI as a step in the existing repo-guards job, so it executes on every pull request on a GitHub-hosted runner. It was negative-tested: a planted duplicate with renamed identifiers fails with exit code 1 and a per-member report naming each twin's file and line range.

The deduplication

Every finding the detector reported was fixed with a plain function or generic type — no macros — per the repo DRY rule:

• The six copy-pasted stream newtypes in zaino-state/src/stream.rs collapse into one generic ChannelStream<T>; the original six names survive as type aliases, so no call site changed.
• FinalisedTxOutSetInfoAccumulator::apply_added_output/apply_removed_output share one body parameterized by a private OutputDelta enum; the XOR fold that combine also repeated is one method.
• The median-time-past walk, duplicated between MockchainSource and the validator connector (and carrying a TODO prescribing exactly this fix), is one function generic over the per-block fetch closure.
• The ~130-line get_block_range/get_block_range_nullifiers twins share spawn_block_range_stream, parameterized over the per-block mapping (identity vs compact_block_to_nullifiers).
• RpcRequestError classification happens once in RpcRequestFallback::classify, adopted by the MempoolError, NonFinalisedStateError, and FinalisedStateError conversions. The gate itself surfaced the third copy after the first two were unified.
• Deduplicating the Broadcast/BroadcastSubscriber Debug impls fixes a copy-paste bug: the subscriber printed itself as "Broadcast" and labeled its watch::Receiver a Sender.
• BlockData::new and BlockMetadata::new were false twins — unrelated types whose field-copy constructors merely rhyme structurally — so both no-value positional constructors are deleted in favor of named struct literals at their call sites.
• In live-tests, the five helper twins shared by e2e/tests/devtool.rs and devtool_zcashd.rs (plus their near-duplicate launch preambles) become generic bodies in e2e::devtool, with the semantically load-bearing difference — which pool a shield lands in — lifted into an explicit parameter; the clientless get_block_header oracle closures share clientless::assert_get_block_header_matches; and the orchard/ironwood coinbase predicates share is_valid_shielded_coinbase over a CoinbaseRewardPool enum.

Verification

cargo check --all-targets, cargo clippy --all-targets, and cargo fmt --all --check are green on the production set, as are the workbench crate's fmt/clippy/tests and cargo check --all-targets for the e2e and clientless crates. Two caveats are pre-existing and were verified by stash-testing the clean tree: the --all-features clippy failure in write_core.rs (transparent_address_history_experimental bit-rot), and the zcashd_support feature path not compiling (nothing forwards legacy-stack to zcash_local_net), which leaves the devtool_zcashd.rs changes consistent with the zebrad column but compiler-unverified.

🤖 Generated with Claude Code