chore(lint): restore god-level clippy bar as a ratchet (#61)

[joeldsouzax]

Closes the config half of #61 (the bar is live); #61 stays open for the de-quarantine tail.

What this does

Re-adopts nexus's elite clippy config over the vendored kameo fork as a lint ratchet: the full god-level bar is deny workspace-wide, so all new production code is held to it from line one. The 38 vendored lib/bin files that predate the bar each carry a documented per-file quarantine header:

// --- #61 quarantine (vendored kameo, pre-god-level-bar) ---
#![allow(clippy::all, clippy::pedantic, clippy::nursery, /* …restriction wall… */,
    reason = "Vendored kameo predating the #61 god-level clippy bar; … New code is not exempt. See #61.")]

These headers leave the tree file-by-file as M1/M7 rewrite or delete the code.

Key decisions

• Dropped the disallowed_types std::sync::Mutex/RwLock ban (deviation from nexus-verbatim). The real invariant is "no lock held across .await" — a per-site call (cleanup: parking_lot for the supervision link graph #52), not a type rule. Production has zero std::sync::Mutex today, so the ban would only forbid a future-correct use. Documented in clippy.toml.
• Gate scope = default targets (lib + bins), not --all-targets. The ~60 BDD-wiring/example/bench files trip 2,000+ pedantic/nursery style findings whose cleanup buys nothing on code whose job is test clarity — and the project already declares a lighter test bar via allow-unwrap-in-tests/allow-expect-in-tests. Gating the test surface is a separate chore: god-level clippy — adopt nexus elite lint config #61-tail decision.
• No -- --deny warnings. The deny-level [workspace.lints.clippy] bar itself fails the build on any violation; rust-level warnings (unused/dead-code in vendored kameo) stay non-blocking until the rust-lints tightening in the tail.
• Crate roots fixed inline (src/lib.rs, actors/src/lib.rs) rather than blanket-quarantined (a crate-root #![allow] would un-lint future core/M1 code).

Deferred to the #61 tail

• The optional [workspace.lints.rust] tightening: unsafe_code (kameo's error.rs transmute needs a per-site allow), dead_code, unreachable_pub, missing_docs.
• Gating the test/example/bench surface.
• De-quarantining the 38 files as they are cleaned or deleted.

Verification

nix flake check green — all 14 gates including the restored bombay-clippy, plus the full BDD/property nextest suite (unchanged by the allow-only headers), doctest, taplo, fmt, audit, deny.