feat(agents): add Rust language support (#523)

* feat(agents): add Rust language support — reviewer, build resolver, patterns, and testing

Add Rust-specific agents and skills following the established Go/Kotlin pattern:
- agents/rust-reviewer.md: ownership, lifetimes, unsafe audit, clippy, error handling
- agents/rust-build-resolver.md: cargo build errors, borrow checker, dependency resolution
- skills/rust-patterns/SKILL.md: idiomatic Rust patterns and best practices
- skills/rust-testing/SKILL.md: TDD, unit/integration/async/property-based testing

* fix(agents): correct Rust examples for accuracy and consistency

- unsafe fn: add inner unsafe {} block for Rust 2024 edition compliance
- edition: update from 2021 to 2024 as current default
- rstest: add missing fixture import
- mockall: add missing predicate::eq import
- concurrency: use sync_channel (bounded) and expect() over unwrap()
  to align with rust-reviewer's HIGH-priority review checks

* fix(skills): correct compilation issues in Rust code examples

- collect: add .copied() for &str iterator into String
- tokio import: remove unused sleep, keep Duration
- async test: add missing Duration import

* fix(skills): move --no-fail-fast before test-binary args

--no-fail-fast is a Cargo option, not a test binary flag.
Placing it after -- forwards it to the test harness where it is
unrecognized.

* fix(agents): distinguish missing cargo-audit from real audit failures

Check if cargo-audit is installed before running it, so actual
vulnerability findings are not suppressed by the fallback message.

* fix: address automated review findings across all Rust files

- build-resolver: prefer scoped cargo update over full refresh
- testing: add Cargo.toml bench config with harness = false for criterion
- testing: condense TDD example to stay under 500-line limit
- patterns: use expect() over unwrap() on JoinHandle for consistency
- patterns: add explicit lifetime to unsafe FFI return reference
- reviewer: replace misleading "string interpolation" with concrete alternatives

* fix: align with CONTRIBUTING.md conventions

- skills: rename "When to Activate" to "When to Use" per template
- reviewer: add cargo check gate before starting review

* fix(agents): guard cargo-audit and cargo-deny with availability checks

Match the pattern used in rust-build-resolver to avoid command-not-found
errors when optional tools are not installed.

* fix: address second round of automated review findings

- testing: split TDD example into separate code blocks to avoid
  duplicate fn definition in single block
- build-resolver/reviewer: use if/then/else instead of && ... ||
  chaining for cargo-audit/deny to avoid masking real failures
- build-resolver: add MSRV caveat to edition upgrade guidance

* feat: add Rust slash commands for build, review, and test

Add commands/rust-build.md, commands/rust-review.md, and
commands/rust-test.md to provide consistent user entrypoints
matching the existing Go and Kotlin command patterns.

* fix(commands): improve rust-build accuracy and tone

- Restructure-first borrow fix example instead of clone-first
- Realistic cargo test output format (per-test lines, not per-file)
- Align "Parse Errors" step with actual resolver behavior
- Prefer restructuring over cloning in common errors table

* fix: address cubic-dev-ai review findings on commands

- Gate review on all automated checks, not just cargo check
- Use git diff HEAD~1 / git diff main...HEAD for PR file selection
- Fix #[must_use] guidance: Result is already must_use by type
- Remove error-masking fallback on cargo tree --duplicates

* fix: address remaining review findings across all bots

- Add rust-reviewer and rust-build-resolver to AGENTS.md registry
- Update agent count from 16 to 18
- Mark parse_config doctest as no_run (body is todo!())
- Add "How It Works" section to both Rust skills
- Replace cargo install with taiki-e/install-action in CI snippet
- Trim tarpaulin section to stay under 500-line limit

* fix(agents): align rust-reviewer invocation with command spec

- Use git diff HEAD~1 / main...HEAD instead of bare git diff
- Add cargo test as explicit step before review begins

* fix(skills): address cubic review on patterns and testing

- Remove Tokio-specific language from How It Works summary
- Add cargo-llvm-cov install note in coverage section
- Revert no_run on doctest examples (illustrative code, not compiled)

* fix(skills): use expect on thread join for consistency

Replace handle.join().unwrap() with .expect("worker thread panicked")
to match the .expect("mutex poisoned") pattern used above.

* fix(agents): gate review on all automated checks, not just cargo check

Consolidate check/clippy/fmt/test into a single gate step that
stops and reports if any fail, matching the command spec.

* fix(skills): replace unwrap with expect in channel example

Use .expect("receiver disconnected") on tx.send() for consistency
with the .expect() convention used in all other concurrency examples.

* fix: address final review round — OpenCode mirrors, counts, examples

- Add .opencode/commands/rust-{build,review,test}.md mirrors
- Add .opencode/prompts/agents/rust-{build-resolver,reviewer}.txt mirrors
- Fix AGENTS.md count to 20 (add missing kotlin agents to table)
- Fix review example: all checks pass (consistent with gate policy)
- Replace should_panic doctest with is_err() (consistent with best practices)
- Trim testing commands to stay at 500-line limit

* fix: address cubic and greptile review on OpenCode files and agents

- Fix crate::module import guidance (internal path, not Cargo.toml)
- Add cargo fmt --check to verification steps
- Fix TDD GREEN example to handle error path (validate(input)?)
- Scope .context() guidance to anyhow/eyre application code
- Update command count from 40 to 51
- Add tokio channel variants to unbounded channel warning
- Preserve JoinError context in spawned task panic message

* fix: stale command count, channel guidance, cargo tree fallback

- Fix stale command count in Project Structure section (40→51)
- Clarify unbounded channel rule: context-appropriate bounded alternatives
- Remove dead cargo tree fallback (exits 0 even with no duplicates)
- Sync OpenCode reviewer mirror with tokio channel coverage

agents/rust-reviewer.md

@@ -0,0 +1,93 @@
+---
+name: rust-reviewer
+description: Expert Rust code reviewer specializing in ownership, lifetimes, error handling, unsafe usage, and idiomatic patterns. Use for all Rust code changes. MUST BE USED for Rust projects.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+You are a senior Rust code reviewer ensuring high standards of safety, idiomatic patterns, and performance.
+
+When invoked:
+1. Run `cargo check`, `cargo clippy -- -D warnings`, `cargo fmt --check`, and `cargo test` — if any fail, stop and report
+2. Run `git diff HEAD~1 -- '*.rs'` (or `git diff main...HEAD -- '*.rs'` for PR review) to see recent Rust file changes
+3. Focus on modified `.rs` files
+4. Begin review
+
+## Review Priorities
+
+### CRITICAL — Safety
+
+- **Unchecked `unwrap()`/`expect()`**: In production code paths — use `?` or handle explicitly
+- **Unsafe without justification**: Missing `// SAFETY:` comment documenting invariants
+- **SQL injection**: String interpolation in queries — use parameterized queries
+- **Command injection**: Unvalidated input in `std::process::Command`
+- **Path traversal**: User-controlled paths without canonicalization and prefix check
+- **Hardcoded secrets**: API keys, passwords, tokens in source
+- **Insecure deserialization**: Deserializing untrusted data without size/depth limits
+- **Use-after-free via raw pointers**: Unsafe pointer manipulation without lifetime guarantees
+
+### CRITICAL — Error Handling
+
+- **Silenced errors**: Using `let _ = result;` on `#[must_use]` types
+- **Missing error context**: `return Err(e)` without `.context()` or `.map_err()`
+- **Panic for recoverable errors**: `panic!()`, `todo!()`, `unreachable!()` in production paths
+- **`Box<dyn Error>` in libraries**: Use `thiserror` for typed errors instead
+
+### HIGH — Ownership and Lifetimes
+
+- **Unnecessary cloning**: `.clone()` to satisfy borrow checker without understanding the root cause
+- **String instead of &str**: Taking `String` when `&str` or `impl AsRef<str>` suffices
+- **Vec instead of slice**: Taking `Vec<T>` when `&[T]` suffices
+- **Missing `Cow`**: Allocating when `Cow<'_, str>` would avoid it
+- **Lifetime over-annotation**: Explicit lifetimes where elision rules apply
+
+### HIGH — Concurrency
+
+- **Blocking in async**: `std::thread::sleep`, `std::fs` in async context — use tokio equivalents
+- **Unbounded channels**: `mpsc::channel()`/`tokio::sync::mpsc::unbounded_channel()` need justification — prefer bounded channels (`tokio::sync::mpsc::channel(n)` in async, `sync_channel(n)` in sync)
+- **`Mutex` poisoning ignored**: Not handling `PoisonError` from `.lock()`
+- **Missing `Send`/`Sync` bounds**: Types shared across threads without proper bounds
+- **Deadlock patterns**: Nested lock acquisition without consistent ordering
+
+### HIGH — Code Quality
+
+- **Large functions**: Over 50 lines
+- **Deep nesting**: More than 4 levels
+- **Wildcard match on business enums**: `_ =>` hiding new variants
+- **Non-exhaustive matching**: Catch-all where explicit handling is needed
+- **Dead code**: Unused functions, imports, or variables
+
+### MEDIUM — Performance
+
+- **Unnecessary allocation**: `to_string()` / `to_owned()` in hot paths
+- **Repeated allocation in loops**: String or Vec creation inside loops
+- **Missing `with_capacity`**: `Vec::new()` when size is known — use `Vec::with_capacity(n)`
+- **Excessive cloning in iterators**: `.cloned()` / `.clone()` when borrowing suffices
+- **N+1 queries**: Database queries in loops
+
+### MEDIUM — Best Practices
+
+- **Clippy warnings unaddressed**: Suppressed with `#[allow]` without justification
+- **Missing `#[must_use]`**: On non-`must_use` return types where ignoring values is likely a bug
+- **Derive order**: Should follow `Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize`
+- **Public API without docs**: `pub` items missing `///` documentation
+- **`format!` for simple concatenation**: Use `push_str`, `concat!`, or `+` for simple cases
+
+## Diagnostic Commands
+
+```bash
+cargo clippy -- -D warnings
+cargo fmt --check
+cargo test
+if command -v cargo-audit >/dev/null; then cargo audit; else echo "cargo-audit not installed"; fi
+if command -v cargo-deny >/dev/null; then cargo deny check; else echo "cargo-deny not installed"; fi
+cargo build --release 2>&1 | head -50
+```
+
+## Approval Criteria
+
+- **Approve**: No CRITICAL or HIGH issues
+- **Warning**: MEDIUM issues only
+- **Block**: CRITICAL or HIGH issues found
+
+For detailed Rust code examples and anti-patterns, see `skill: rust-patterns`.