main is not cargo-fmt-clean: every PR inherits the red, and #143/#144 duplicate the repair #147

main is not cargo fmt-clean. Every branch cut from it inherits the failure, and because the Cargo fmt step runs before Cargo clippy and before the Cargo test job, a formatting diff on main silently costs every PR its clippy run and its test run.

Measured 2026-10-31 at main = 1933490, with rustfmt output reconstructed from #144 (which was produced by real rustup run stable cargo fmt; the reconstruction reproduces all eight of #144's files byte-for-byte except one non-formatting hunk):

The last three are invisible to cargo fmt --all: verification/ is in root Cargo.toml's exclude, and the contracts fixture is a separate package. They will still trip anyone who runs cargo fmt in those directories.

The coordination problem

#143 and #144 both carry the same 8-file reformat — same files, same hunks (#143 as commit d397aa7, #144 as its own PR). Two independent repairs of one defect, and neither is merged, so the defect persists on main and grows with every branch.

Acceptance criteria

• One of fix(ci): align secret scanner permissions and enable verified canaries #143/style(rust): repair the existing cargo fmt CI gate #144 lands; the other is closed as superseded rather than merged on top (to avoid a conflicting second reformat)
• cargo fmt --all -- --check exits 0 on a fresh clone of main
• Cargo fmt is green on main, so the clippy and test jobs actually execute on subsequent PRs
• The three out-of-workspace files are either formatted or explicitly declared out of scope (they are not covered by cargo fmt --all)
• Discharging Creusot obligations is not claimed as a result: verification/ is excluded from the workspace's stable --locked build

Why this is filed rather than fixed here

PR #145 adds the classifier and needs this to land first, but PR #145 does not fix it and must not carry a third copy of the reformatting. Its own files are measured clean against the same oracle (0 files deviate), so once #143/#144 lands, fmt goes green on rebase with no further edits.