ci: deny unwrap_used/expect_used on the library target

Add [lints.clippy] unwrap_used = "deny", expect_used = "deny" plus a tracked
pre-commit hook running `cargo clippy --lib -- -D warnings`. Library code may
not hide a panic behind unwrap/expect; panic!/unreachable! stay un-linted as
the explicit sanctioned form. Gate is the library target only — tests and
examples are not gated. A fresh clone must run
`git config core.hooksPath .githooks` to enable the hook.

Cargo.toml

@@ -7,6 +7,15 @@ rust-version = "1.95"
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ["cfg(loom)"] }
 
+[lints.clippy]
+# Library code must never hide a panic behind unwrap/expect. Both are denied; an
+# intentional panic is written explicitly as `match { Err(e) => panic!(..) }`.
+# panic!/unreachable! are deliberately left un-linted as the blessed explicit
+# form. Enforced on the library target only (`cargo clippy --lib`); tests and
+# examples unwrap freely and are not gated.
+unwrap_used = "deny"
+expect_used = "deny"
+
 [features]
 default = ["rq-mutex"]
 smarm-trace = []