ci(cmux-tui): keep panic ratchet in PR lint
The Rust panic ratchet ran only in dispatch CI, so deny hits reached base without being checked on PRs. This PR adds a production-target ratchet to changed-package PR lint, and runs the whole workspace for baseline, ratchet-script, or plan changes.
The rollout baseline records existing hits on current base so enabling this step does not make every Rust PR fail. This is an intentional, independently reviewed rollout exception: normal comparisons and the lowering-only --update-baseline command are unchanged. #28134 and #28315 carry the runtime fixes that can lower deny counts afterward.
The branch includes base fe3152a7c46f4c84343381db050bb080123df8e8. Linux run 41064231071 measured head 08d80d037c55287f4fca38b81212f3cec14946f3 in a real checkout. Clippy completed successfully across 75 crates; the comparison then failed on the three deny overages listed below. Its MEASURED_COUNTS output supplies every new value in this table.
| Crate | Lint | Previous baseline | Rollout baseline | Measurement |
|---|---|---|---|---|
acpmux | indexing_slicing | 693 | 731 | 41064231071 |
acpmux | string_slice | 94 | 97 | 41064231071 |
acpmux | arithmetic_side_effects | 978 | 1430 | 41064231071 |
acpmux | cast_possible_truncation | 113 | 215 | 41064231071 |
cmux-app-host | arithmetic_side_effects | 11 | 15 | 41064231071 |
cmux-app-host | cast_possible_truncation | 13 | 17 | 41064231071 |
cmux-browser-host | arithmetic_side_effects | 155 | 158 | 41064231071 |
cmux-git | arithmetic_side_effects | 9 | 10 | 41064231071 |
cmux-layout-reducer | arithmetic_side_effects | 56 | 58 | 41064231071 |
cmux-remote | arithmetic_side_effects | 105 | 107 | 41064231071 |
cmux-remote | cast_possible_truncation | 10 | 12 | 41064231071 |
cmux-tui | indexing_slicing | 833 | 861 | 41064231071 |
cmux-tui | arithmetic_side_effects | 1115 | 1188 | 41064231071 |
cmux-tui | cast_possible_truncation | 133 | 138 | 41064231071 |
cmux-tui-cloud-conversations | arithmetic_side_effects | 19 | 20 | 41064231071 |
cmux-tui-core | arithmetic_side_effects | 830 | 875 | 41064231071 |
cmux-tui-core | cast_possible_truncation | 89 | 92 | 41064231071 |
cmux-tui-image-paste | arithmetic_side_effects | 11 | 12 | 41064231071 |
cmux-worktree-care | arithmetic_side_effects | 13 | 15 | 41064231071 |
These are all raised counts relative to the base baseline. No lint or production target is removed. The 17 focused Python tests include a baseline-only change forcing the full workspace ratchet.
Related design: cmuxterm-hq#5123 and plans/cmux-next/rust-panic-free.md.
Validation at 67055be52051c0cca4037de5d1b64eb5363ae080: Linux fast checks 41067025280 passed all 17 focused tests and the full workspace ratchet. The actual PR clippy job and its new ratchet step also passed in 41066767546. Independent router review: SHIP, no correctness findings. Historical run 41055031763 measured c6f3906, not the current head, and is not claimed as final validation. The old acpmux arithmetic value 1418 was measured by 41046731561; the current 1430 comes from 41064231071 above.
Remaining guard-test failures were replayed on base fe3152a7c46f in 41072849614. scripts/ci/test_reds.py classify reported own: false for DigestTests.test_the_repository_highlights_validate and SigningHooksInStepWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check. The Python execution-registry failure for test_cmux_tui_owned_mini_caches.py also reproduces on base. Public API-boundary diagnostics name five legacy CLI aliases in unchanged cli.rs; the scanner and those source bytes are identical to base.
Changelog
none
risk:normal (enables a new blocking PR check; measured rollout baseline avoids introducing pre-existing failures).
Agent session: agent session