chore: namespace the load-test cargo cache key and lint the wasm32 targets

[FSM1]

Two CI gate hygiene fixes. No product code changes behaviour.

chore(ci): give load-test its own cargo cache key

load-test.yml built crates/load under --release while it wrote and restored the
shared linux-cargo- cache key. It now uses load-test-cargo-, the way perf-bench.yml
uses perf-bench-cargo-.

Closes #1408.

chore(ci): lint the wasm32 targets with clippy

Every clippy invocation in the repository named a host target, so a wasm32-only lint
shipped unseen. The Core KATs (native + WASM) job in ci-rust.yml already installs
wasm32-wasip1 and wasm32-unknown-unknown, so the leg lands there. It runs clippy with
-D warnings over cipherbox-core, cipherbox-engine and cipherbox-wasm on both
targets.

The leg uses --lib --tests, not --all-targets: the criterion benches have no wasm
build, so --all-targets fails to compile for both wasm32 targets.

The one outstanding lint the gate would have caught, manual_range_contains in the web
storage headroom policy, is fixed in the same commit. The rewritten expression
(0.0..OVER_U64).contains(&bytes) is the same two comparisons in the same order, so NaN,
both infinities, negatives and out-of-range values still fall to UNMEASURED. The
existing test only_a_whole_in_range_headroom_reads_as_measured covers all of them and
runs under wasm32-unknown-unknown in this same job.

Closes #1510.

Body checks / follow-ups filed

• ci: load-test.yml writes the shared linux-cargo- cache key while building release #1408 body check appended. The body claimed that the pull-request gate jobs restore the
  linux-cargo- key. They do not: the gate uses Swatinem/rust-cache with the shared
  keys workspace, core-kats, adapters, desktop, client-browser and
  wasm-engine. The other writer of linux-cargo- is desktop-release.yml at lines
  194-195. The collision was therefore between two unrelated release builds. The fix is
  unchanged, and after this change desktop-release.yml is the sole owner of that key.
• ci: lint the wasm32 target with clippy #1510 body check appended, and the missing v2-build label added. The cited lint site
  moved from crates/wasm/src/host.rs:101 to :108. The implemented scope is recorded
  there: both targets, three packages, --lib --tests.
• No follow-up issue filed. Nothing was found that needed one.

Verification

• cargo fmt --all --check
• cargo clippy --workspace --exclude cipherbox-desktop --exclude cipherbox-contract --all-targets -- -D warnings
• cargo clippy -p cipherbox-core -p cipherbox-engine -p cipherbox-wasm --lib --tests --target wasm32-unknown-unknown -- -D warnings
• the same command for --target wasm32-wasip1
• cargo test -p cipherbox-wasm
• zizmor --no-online-audits .github/workflows/ .github/actions/ reports no findings
• pnpm lint:tracker-refs

Summary by CodeRabbit

• Chores
  • Expanded automated quality checks for WebAssembly builds, including library and test code.
  • Improved build-cache isolation for load-test workflows to prevent interference with other release builds.
  • Clarified the handling of measured storage capacity values without changing storage-policy behavior. Invalid, fractional, or out-of-range values continue to be treated as unmeasured.

Note

Add wasm32 Clippy lint in ci-rust.yml, namespace load-test cache key, and simplify web_storage_policy bounds check

• Adds a Clippy step to the workspace-tests job that lints cipherbox-core, cipherbox-engine, and cipherbox-wasm (library and test targets, warnings denied) across wasm32-wasip1 and wasm32-unknown-unknown
• Switches the load-test job's Cargo cache key from the shared linux-cargo namespace to load-test-cargo so it no longer collides with other jobs
• Replaces explicit lower/upper-bound comparisons in web_storage_policy (host.rs) with an equivalent half-open range check for the integral headroom value
• Risk: the workspace-tests job now fails on Clippy warnings in the selected wasm32 packages; pre-existing warnings in those packages will break CI

^{Macroscope summarized 2125a84.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2a728829-d0b5-4bb1-8821-fbb75eca8ca4

📥 Commits

Reviewing files that changed from the base of the PR and between 690814f and 2125a84.

📒 Files selected for processing (3)

• .github/workflows/ci-rust.yml
• .github/workflows/load-test.yml
• crates/wasm/src/host.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pull request adds clippy checks for two WASM targets, rewrites an equivalent range guard, and gives the load-test workflow a dedicated Cargo cache namespace.

Changes

WASM validation

Layer / File(s)	Summary
WASM clippy coverage and range check .github/workflows/ci-rust.yml, crates/wasm/src/host.rs	The core-kats job runs clippy with denied warnings for the core, engine, and WASM crates on both supported WASM targets. The storage headroom guard uses (0.0..OVER_U64).contains(&bytes) without changing its behavior.

Load-test cache isolation

Layer / File(s)	Summary
Dedicated load-test Cargo cache .github/workflows/load-test.yml	The load-test workflow uses load-test-cargo- for its cache key and restore prefix instead of linux-cargo-.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to 2125a

The PR adds targeted WASM lint coverage, preserves storage-policy behavior, and isolates the load-test cache without an identified functional or CI regression.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR meets #1408 by changing the load-test cache key and restore-key prefix from linux-cargo- to load-test-cargo-. It meets #1510 by adding denied-warning cargo clippy checks for `cipherbox-co…
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the two linked objectives. The workflow cache-key change supports #1408. The wasm clippy checks and the range-containment lint fix support #1510. No unrelated sourc…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 …
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the two main changes: isolating the load-test Cargo cache key and adding linting for wasm32 targets.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/1408-1510-load-test-cache-key-and-wasm-clippy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[FSM1]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.