ci(rust): add always-on Rust Gate + clear latent clippy debt

[systemslibrarian]

Follow-up to the branch-protection work: makes the Rust clippy/test suite enforceable and clears the latent lint debt so it starts green.

1. New required-check-safe gate: .github/workflows/rust-gate.yml

The comprehensive Rust workflows (rust-crypto.yml, rust-security-suite.yml) are path-filtered to rust_crypto/** + crypto_core/**. Making a path-filtered check required deadlocks every non-Rust PR (the check never runs → PR waits forever — the exact problem that kept the Rust checks out of branch protection).

This new job has no path filter, so it always runs and always reports a conclusion. It runs cargo clippy --workspace --all-targets -- -D warnings + cargo test -p crypto_core only when Rust sources changed, and passes trivially otherwise. Detection is fail-safe: if the diff can't be computed, it runs the checks rather than skipping.

Once green, I'll add Rust Gate (clippy + tests) to the required checks alongside Preflight.

2. Clear all outstanding clippy -D warnings findings

A newer clippy (1.96) flags these; CI's current clippy doesn't yet — fixing pre-emptively so the gate is green from day one and a future toolchain bump doesn't break it:

• secure_alloc.rs: manual div-ceil → usize::div_ceil
• meow_fountain/wire.rs: repeat().take() → repeat_n (test data)
• crypto_core coverage test: drop redundant explicit deref
• rust_crypto coverage test: a >= x && a <= y → (x..=y).contains()

Verified locally: cargo clippy --workspace --all-targets -- -D warnings exits clean, cargo test -p crypto_core passes.

🤖 Generated with Claude Code