chore(gates): zero clippy warnings and a buildable sandbox example on Windows

The full-workspace gates had never run on this platform: collapsible
ifs in the Windows shell probe, a same-type cast in the crash handler,
an unused AsRawHandle import, and the sandbox smoke-test example
building its unix-only body (libc, kernel enforcement) unconditionally.
The example now stubs main off-unix; formatting reflow from cargo fmt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KSy9S31pZNWXtRZNVJ1sDf

crates/codegen/kigi-config/src/shell.rs

@@ -78,11 +78,10 @@ pub fn detect_windows_shell() -> &'static WindowsShell {
             kigi_tty_utils::detach_std_command(&mut cmd);
             cmd.arg("pwsh.exe").stdin(std::process::Stdio::null());
             cmd.output()
-        } {
-            if output.status.success() {
-                tracing::info!("Windows shell: pwsh");
-                return WindowsShell::Pwsh;
-            }
+        } && output.status.success()
+        {
+            tracing::info!("Windows shell: pwsh");
+            return WindowsShell::Pwsh;
         }
 
         // powershell.exe (Windows PowerShell 5.1).
@@ -131,14 +130,13 @@ fn find_git_bash() -> Option<String> {
         kigi_tty_utils::detach_std_command(&mut cmd);
         cmd.arg("bash.exe").stdin(std::process::Stdio::null());
         cmd.output()
-    } {
-        if output.status.success() {
-            let stdout = String::from_utf8_lossy(&output.stdout);
-            for line in stdout.lines() {
-                let line = line.trim();
-                if line.to_ascii_lowercase().contains("git") {
-                    return Some(line.to_string());
-                }
+    } && output.status.success()
+    {
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        for line in stdout.lines() {
+            let line = line.trim();
+            if line.to_ascii_lowercase().contains("git") {
+                return Some(line.to_string());
             }
         }
     }

crates/codegen/kigi-crash-handler/src/handler.rs

@@ -616,7 +616,7 @@ mod win {
             }
 
             let signal = exception_to_signal(exception_code);
-            let si_code = exception_code as i32;
+            let si_code = exception_code;
 
             // ExceptionInformation[1] holds the faulting address for ACCESS_VIOLATION.
             let si_addr = if exception_code == EXCEPTION_ACCESS_VIOLATION

crates/codegen/kigi-sampling-types/src/error.rs

@@ -388,7 +388,9 @@ mod tests {
 
     #[test]
     fn retryable_api_status_covers_edge_5xx_and_excludes_broken_tls() {
-        for status in [429u16, 500, 502, 503, 504, 520, 521, 522, 523, 524, 529, 530, 599] {
+        for status in [
+            429u16, 500, 502, 503, 504, 520, 521, 522, 523, 524, 529, 530, 599,
+        ] {
             assert!(is_retryable_api_status(status), "should retry {status}");
         }
         // Cloudflare 525/526: origin TLS handshake / invalid certificate —

crates/codegen/kigi-sandbox/examples/sandbox_smoke_test.rs

@@ -14,9 +14,19 @@
 //! cargo run -p kigi-sandbox --example sandbox_smoke_test -- read-only
 //! ```
 
+// Kernel enforcement is unix-only (Seatbelt / Landlock); Windows builds a
+// stub so `--all-targets` stays green everywhere.
+#[cfg(unix)]
 use kigi_sandbox::{ProfileName, SandboxManager};
+#[cfg(unix)]
 use std::path::Path;
 
+#[cfg(not(unix))]
+fn main() {
+    eprintln!("sandbox_smoke_test exercises kernel enforcement and only runs on Unix.");
+}
+
+#[cfg(unix)]
 fn main() {
     let profile_name = std::env::args()
         .nth(1)
@@ -121,6 +131,7 @@ fn main() {
     println!("\n✅ Smoke test complete");
 }
 
+#[cfg(unix)]
 fn test_read(label: &str, path: &Path) {
     if path.is_file() {
         match std::fs::read(path) {
@@ -150,6 +161,7 @@ fn test_read(label: &str, path: &Path) {
     }
 }
 
+#[cfg(unix)]
 fn test_write(label: &str, path: &Path) {
     match std::fs::write(path, b"sandbox-test") {
         Ok(()) => {

crates/codegen/kigi-shell/src/agent/models.rs

@@ -1959,46 +1959,47 @@ fn spawn_prefetch_thread(env: PrefetchEnv) -> Option<EarlyPrefetchHandle> {
     let spawned = std::thread::Builder::new()
         .name("early-prefetch".into())
         .spawn(move || {
-        let mut timer = crate::instrumentation_timer!("startup.early_prefetch");
-        let proxy_endpoint = env.endpoints.proxy_url();
-        timer.with_field("endpoint", proxy_endpoint.as_str());
-        // Resolve each stored subscription-OAuth session's bearer (refreshed
-        // on expiry) so those platforms are part of the STARTUP fetch plan —
-        // otherwise a claude-pro-max-only user boots onto the bundled Kimi
-        // table until some later async refresh happens to run, and the cache
-        // origin (which encodes enabled platforms) never matches the
-        // async-path's claude-inclusive origin.
-        let oauth_tokens = tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .map(|rt| {
-                rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens(
-                    &crate::auth::oauth_registry::pool_home(),
-                ))
-            })
-            .unwrap_or_default();
-        let models = prefetch_models_blocking(
-            &env.endpoints,
-            env.auth.as_ref(),
-            &oauth_tokens,
-            env.model_fetch_auth,
-            &env.platform_keys,
-        );
-        if (env.endpoints.deployment_key.is_some() || crate::managed_config::has_active_team_auth())
-            && crate::config::is_managed_config_stale_for(
-                &crate::managed_config::current_serving_identity(),
-            )
-            && crate::managed_config::is_fetch_enabled()
-            && let Ok(rt) = tokio::runtime::Builder::new_current_thread()
+            let mut timer = crate::instrumentation_timer!("startup.early_prefetch");
+            let proxy_endpoint = env.endpoints.proxy_url();
+            timer.with_field("endpoint", proxy_endpoint.as_str());
+            // Resolve each stored subscription-OAuth session's bearer (refreshed
+            // on expiry) so those platforms are part of the STARTUP fetch plan —
+            // otherwise a claude-pro-max-only user boots onto the bundled Kimi
+            // table until some later async refresh happens to run, and the cache
+            // origin (which encodes enabled platforms) never matches the
+            // async-path's claude-inclusive origin.
+            let oauth_tokens = tokio::runtime::Builder::new_current_thread()
                 .enable_all()
                 .build()
-        {
-            crate::managed_config::clear_orphan();
-            let _ = rt.block_on(crate::managed_config::sync());
-        }
+                .map(|rt| {
+                    rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens(
+                        &crate::auth::oauth_registry::pool_home(),
+                    ))
+                })
+                .unwrap_or_default();
+            let models = prefetch_models_blocking(
+                &env.endpoints,
+                env.auth.as_ref(),
+                &oauth_tokens,
+                env.model_fetch_auth,
+                &env.platform_keys,
+            );
+            if (env.endpoints.deployment_key.is_some()
+                || crate::managed_config::has_active_team_auth())
+                && crate::config::is_managed_config_stale_for(
+                    &crate::managed_config::current_serving_identity(),
+                )
+                && crate::managed_config::is_fetch_enabled()
+                && let Ok(rt) = tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+            {
+                crate::managed_config::clear_orphan();
+                let _ = rt.block_on(crate::managed_config::sync());
+            }
 
-        EarlyPrefetchResult { models }
-    });
+            EarlyPrefetchResult { models }
+        });
     match spawned {
         Ok(handle) => Some(handle),
         Err(e) => {

crates/codegen/kigi-shell/src/auth/storage.rs

@@ -900,9 +900,8 @@ mod write_fallback_tests {
     fn atomic_write_reclaims_tmp_when_store_write_fails() {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("auth.json");
-        let err =
-            write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail)
-                .unwrap_err();
+        let err = write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail)
+            .unwrap_err();
         assert_eq!(err.kind(), std::io::ErrorKind::StorageFull);
 
         let orphans: Vec<_> = std::fs::read_dir(dir.path())

crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs

@@ -33,8 +33,7 @@ pub(crate) fn ctx_with_toggle(toggle: HashMap<String, bool>) -> SubagentSpawnCon
     let (tx, _rx) = mpsc::unbounded_channel();
     SubagentSpawnContext {
         lsp: None,
-        spawn_limits:
-            kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(),
+        spawn_limits: kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(),
         spawn_permits: std::sync::Arc::new(tokio::sync::Semaphore::new(
             kigi_tools::implementations::kigi::task::admission::SubagentLimits::default()
                 .effective_max_concurrent(),

crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs

@@ -187,7 +187,10 @@ mod compaction_tool_choice_tests {
             resolve(Some("bogus"), None, Some("none")),
             CompactionToolChoice::None
         );
-        assert_eq!(resolve(Some("NONE "), None, None), CompactionToolChoice::None);
+        assert_eq!(
+            resolve(Some("NONE "), None, None),
+            CompactionToolChoice::None
+        );
     }
 }
 

crates/codegen/kigi-tools/src/util/spawn.rs

@@ -15,7 +15,8 @@ pub use kigi_tty_utils::{
 pub async fn reap_killed_search_child(
     child: &mut tokio::process::Child,
 ) -> Option<std::process::ExitStatus> {
-    let status = kigi_tty_utils::reap_killed_bounded(child, kigi_tty_utils::KILL_REAP_TIMEOUT).await;
+    let status =
+        kigi_tty_utils::reap_killed_bounded(child, kigi_tty_utils::KILL_REAP_TIMEOUT).await;
     if status.is_none() {
         tracing::warn!(
             reap_timeout_secs = kigi_tty_utils::KILL_REAP_TIMEOUT.as_secs(),

crates/codegen/kigi-tty-utils/src/lib.rs

@@ -567,7 +567,7 @@ pub fn dup_tui_stderr() -> io::Result<std::fs::File> {
         // `DuplicateHandle` — avoiding the `from_raw_handle` footgun
         // where `File` would take ownership of the process stderr handle
         // and close it on drop.
-        use std::os::windows::io::{AsRawHandle, FromRawHandle};
+        use std::os::windows::io::FromRawHandle;
         let stderr_handle = unsafe {
             windows::Win32::System::Console::GetStdHandle(
                 windows::Win32::System::Console::STD_ERROR_HANDLE,