Repair lint coverage, patch advisories, fix pipeline dtype corruption

[anbeckham]

Why

Clippy ran without --all-targets, so nothing under #[cfg(test)] was ever linted. Turning it on immediately surfaced an error-level lint CI could not see. Pulling that thread led to a correctness bug in the distributed pipeline.

The dtype bug (most important part of this PR)

TensorDtype::to_u8/from_u8 mapped F16 => 0, F32 => 1. MeshPipelineHandler — the only consumer of those functions — defines 0 = F32, 1 = F16.

tag	TensorDtype (before)	forward_layers
0	F16	F32
1	F32	F16

So every pipeline hop swapped F16 and F32, in both directions:

• worker.rs:169 sends dtype.to_u8() into forward_layers, which decodes it with the other table.
• worker.rs:210 decodes the handler's returned tag with the mesh table.

A stage receiving F32 activations labelled F16 decodes them at 2 bytes per element instead of 4 — garbage activations, silently.

PipelineInitiator compounded it by hardcoding TensorDtype::F16 on the wire message while discarding the dtype the engine actually returned, and by saving checkpoints under that same wrong dtype (so recovery resumed on garbage too).

These functions are not part of the wire format — TensorDtype travels between peers as a serde enum, and to_u8/from_u8 are used in exactly two places, both at the handler boundary. Realigning them is therefore safe. The tag space is now documented on the trait, and tests assert the literal tags rather than only the round-trip, since a round-trip test passes happily while both sides are consistently wrong.

Security

Patches 5 advisories rather than ignoring them — notably RUSTSEC-2026-0185, a remote memory-exhaustion DoS in quinn-proto, the QUIC transport the mesh runs on. Also rustls-webpki (x3), crossbeam-epoch, and a rand unsoundness.

deny.toml's ignore list is rewritten. Several entries had wrong justifications: RUSTSEC-2024-0370 was labelled "bincode: crafted input DoS" but is actually proc-macro-error unmaintained; 2024-0436 was labelled "fxhash" but is paste. Every remaining entry was re-verified against the advisory DB. The two quick-xml vulnerabilities cannot be patched — self_update 0.42 pins ^0.37 and plist 1.8 (via Tauri) pins ^0.38 — so their actual exposure is documented instead.

CLI hang risk

reqwest::Client::new() applies no timeout. share_benchmark_result, documented as "best-effort, never blocks", could block forever. All 8 call sites now use a shared client with connect/request timeouts. The cloud inference client is deliberately left alone — it streams, and a blanket request timeout would truncate long generations.

Also

• Bumps pinned actions to Node 24 runtimes ahead of the 2026-09-16 removal of Node 20 from GitHub runners.

Verification

cargo fmt --check, cargo clippy --workspace --exclude hivebear-web --all-targets -- -D warnings, 331 tests passing, cargo deny check advisories licenses clean, plus -p hivebear-inference --no-default-features as CI does.

⚠️ release.yml and mobile.yml action bumps include download-artifact v4→v8, which changes digest-mismatch from warn to error. I could not exercise a release build here — worth a workflow_dispatch run before the next tagged release.

🤖 Generated with Claude Code