chore(gates): zero clippy warnings and a buildable sandbox example on Windows

The full-workspace gates had never run on this platform: collapsible
ifs in the Windows shell probe, a same-type cast in the crash handler,
an unused AsRawHandle import, and the sandbox smoke-test example
building its unix-only body (libc, kernel enforcement) unconditionally.
The example now stubs main off-unix; formatting reflow from cargo fmt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KSy9S31pZNWXtRZNVJ1sDf

crates/codegen/kigi-shell/src/agent/models.rs

@@ -1959,46 +1959,47 @@ fn spawn_prefetch_thread(env: PrefetchEnv) -> Option<EarlyPrefetchHandle> {
     let spawned = std::thread::Builder::new()
         .name("early-prefetch".into())
         .spawn(move || {
-        let mut timer = crate::instrumentation_timer!("startup.early_prefetch");
-        let proxy_endpoint = env.endpoints.proxy_url();
-        timer.with_field("endpoint", proxy_endpoint.as_str());
-        // Resolve each stored subscription-OAuth session's bearer (refreshed
-        // on expiry) so those platforms are part of the STARTUP fetch plan —
-        // otherwise a claude-pro-max-only user boots onto the bundled Kimi
-        // table until some later async refresh happens to run, and the cache
-        // origin (which encodes enabled platforms) never matches the
-        // async-path's claude-inclusive origin.
-        let oauth_tokens = tokio::runtime::Builder::new_current_thread()
-            .enable_all()
-            .build()
-            .map(|rt| {
-                rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens(
-                    &crate::auth::oauth_registry::pool_home(),
-                ))
-            })
-            .unwrap_or_default();
-        let models = prefetch_models_blocking(
-            &env.endpoints,
-            env.auth.as_ref(),
-            &oauth_tokens,
-            env.model_fetch_auth,
-            &env.platform_keys,
-        );
-        if (env.endpoints.deployment_key.is_some() || crate::managed_config::has_active_team_auth())
-            && crate::config::is_managed_config_stale_for(
-                &crate::managed_config::current_serving_identity(),
-            )
-            && crate::managed_config::is_fetch_enabled()
-            && let Ok(rt) = tokio::runtime::Builder::new_current_thread()
+            let mut timer = crate::instrumentation_timer!("startup.early_prefetch");
+            let proxy_endpoint = env.endpoints.proxy_url();
+            timer.with_field("endpoint", proxy_endpoint.as_str());
+            // Resolve each stored subscription-OAuth session's bearer (refreshed
+            // on expiry) so those platforms are part of the STARTUP fetch plan —
+            // otherwise a claude-pro-max-only user boots onto the bundled Kimi
+            // table until some later async refresh happens to run, and the cache
+            // origin (which encodes enabled platforms) never matches the
+            // async-path's claude-inclusive origin.
+            let oauth_tokens = tokio::runtime::Builder::new_current_thread()
                 .enable_all()
                 .build()
-        {
-            crate::managed_config::clear_orphan();
-            let _ = rt.block_on(crate::managed_config::sync());
-        }
+                .map(|rt| {
+                    rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens(
+                        &crate::auth::oauth_registry::pool_home(),
+                    ))
+                })
+                .unwrap_or_default();
+            let models = prefetch_models_blocking(
+                &env.endpoints,
+                env.auth.as_ref(),
+                &oauth_tokens,
+                env.model_fetch_auth,
+                &env.platform_keys,
+            );
+            if (env.endpoints.deployment_key.is_some()
+                || crate::managed_config::has_active_team_auth())
+                && crate::config::is_managed_config_stale_for(
+                    &crate::managed_config::current_serving_identity(),
+                )
+                && crate::managed_config::is_fetch_enabled()
+                && let Ok(rt) = tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+            {
+                crate::managed_config::clear_orphan();
+                let _ = rt.block_on(crate::managed_config::sync());
+            }
 
-        EarlyPrefetchResult { models }
-    });
+            EarlyPrefetchResult { models }
+        });
     match spawned {
         Ok(handle) => Some(handle),
         Err(e) => {

crates/codegen/kigi-shell/src/auth/storage.rs

@@ -900,9 +900,8 @@ mod write_fallback_tests {
     fn atomic_write_reclaims_tmp_when_store_write_fails() {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("auth.json");
-        let err =
-            write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail)
-                .unwrap_err();
+        let err = write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail)
+            .unwrap_err();
         assert_eq!(err.kind(), std::io::ErrorKind::StorageFull);
 
         let orphans: Vec<_> = std::fs::read_dir(dir.path())

crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs

@@ -33,8 +33,7 @@ pub(crate) fn ctx_with_toggle(toggle: HashMap<String, bool>) -> SubagentSpawnCon
     let (tx, _rx) = mpsc::unbounded_channel();
     SubagentSpawnContext {
         lsp: None,
-        spawn_limits:
-            kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(),
+        spawn_limits: kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(),
         spawn_permits: std::sync::Arc::new(tokio::sync::Semaphore::new(
             kigi_tools::implementations::kigi::task::admission::SubagentLimits::default()
                 .effective_max_concurrent(),

crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs

@@ -187,7 +187,10 @@ mod compaction_tool_choice_tests {
             resolve(Some("bogus"), None, Some("none")),
             CompactionToolChoice::None
         );
-        assert_eq!(resolve(Some("NONE "), None, None), CompactionToolChoice::None);
+        assert_eq!(
+            resolve(Some("NONE "), None, None),
+            CompactionToolChoice::None
+        );
     }
 }