chore: enforce warnings across build configurations (#1200)

* Treat Rust warnings as errors

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix deny-warnings all-target checks

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Enforce warnings across build configurations

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix cross-platform deny-warnings CI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Limit foreground argv probing to supported platforms

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix Windows warnings denied by CI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix Windows test warnings under deny-warnings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix Windows settings test compilation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Gate Windows-unused diff probe helper

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Migrate updater to async ZIP read1 API

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Handle invalid ZIP entry names in read1 API

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Avoid moving ZIP entry name during extraction

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: deny warnings in CI only, keep local builds lenient

Move -D warnings out of .cargo/config.toml so an in-progress local edit
still compiles. The build & test job passes it with --config, which is
appended to the Windows +crt-static rustflags instead of replacing them
the way RUSTFLAGS would. Nightly and release builds no longer fail on
lints; CI gates them. Restore the backdrop parameter name in theme.rs.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>

.github/workflows/ci.yml

@@ -107,6 +107,12 @@ jobs:
     # Line tables keep file:line in backtraces but shrink the cached target dir.
     env:
       CARGO_PROFILE_DEV_DEBUG: line-tables-only
+      # Warnings fail CI, but not local builds: a half-finished edit should
+      # still compile. Passed with `--config` rather than RUSTFLAGS, because
+      # RUSTFLAGS replaces `.cargo/config.toml`'s Windows `+crt-static` (#902)
+      # while a `--config` array is appended to it. Every cargo step takes the
+      # same flags so the tests reuse the build instead of recompiling.
+      DENY_WARNINGS: target.${{ matrix.target }}.rustflags=['-D','warnings']
     # Backstop under the per-step timeouts below. Without any timeout at all a
     # hung test runs to GitHub's six-hour job limit, which is how a 90-second
     # step turned into a six-hour one three times in a day.
@@ -158,7 +164,7 @@ jobs:
         if: needs.changes.outputs.code == 'true'
         # Cold-cache builds have been observed at ~10 min; warm ones at ~90s.
         timeout-minutes: 30
-        run: cargo build --locked --target ${{ matrix.target }}
+        run: cargo build --locked --config "${{ env.DENY_WARNINGS }}" --target ${{ matrix.target }}
 
       # A binary that imports VCRUNTIME140.dll cannot start on a Windows
       # machine that has never installed the Visual C++ Redistributable — the
@@ -199,12 +205,12 @@ jobs:
       - name: Test
         if: needs.changes.outputs.code == 'true'
         timeout-minutes: 20
-        run: cargo test --locked --target ${{ matrix.target }}
+        run: cargo test --locked --config "${{ env.DENY_WARNINGS }}" --target ${{ matrix.target }}
 
       - name: Test desktop updater
         if: needs.changes.outputs.code == 'true'
         timeout-minutes: 10
-        run: cargo test --locked --features updater --bin tty7-updater --target ${{ matrix.target }}
+        run: cargo test --locked --config "${{ env.DENY_WARNINGS }}" --features updater --bin tty7-updater --target ${{ matrix.target }}
 
       # There is deliberately no post-mortem step here, and that is worth
       # recording, because an earlier version of this file had one: on failure it
@@ -251,7 +257,7 @@ jobs:
     # rather than in [profile.release] because the release profile is shared with
     # the GUI builds, which keep their symbols.
     env:
-      RUSTFLAGS: -C strip=symbols
+      RUSTFLAGS: -D warnings -C strip=symbols
     steps:
       - uses: actions/checkout@v4
 
@@ -344,7 +350,7 @@ jobs:
           - target: x86_64-apple-darwin
             arch: x86_64
     env:
-      RUSTFLAGS: -C strip=symbols
+      RUSTFLAGS: -D warnings -C strip=symbols
     steps:
       - uses: actions/checkout@v4