fix(ci): lint the whole workspace, and clear what that exposes (gh#743)

[vsbuffalo]

Fixes #743.

The gate linted one package

cd rust && cargo clippy --all-targets -- -D warnings lints only the current package. rust/Cargo.toml declares the workspace root as a package (camdl-tests), so sim, cli and io compiled as dependencies and were never linted — the check could not go red for anything in the real crates. Adding --workspace makes it real; this PR clears everything that then surfaces.

Workspace clippy is now 0 lints under -D warnings.

The neg_cmp_op_on_partial_ord eighteen — none was a bug

Every one was deliberate NaN handling, several with a comment saying so (obs_loglik cites gh#645). They are rewritten so the NaN arm lives in the code rather than a comment:

-if !(sigma > 0.0) { ... }
+if sigma.is_nan() || sigma <= 0.0 { ... }

Exactly equivalent by truth table. Ten were in sim; eight more surfaced in cli, which clippy had never reached.

NaN coverage added: the boundary_times monotonicity guards, optimize_det bounds, neg_binomial_dispersion, a NaN forcing knot, and a NaN Cond predicate in the flat-VM byte-identity A/B. That last one is verified to have teeth — reverting the guard fails it with eval_resolved=2.0 != eval_flat=1.0.

Two arms are left untested and I would rather say so than pad: odes h fallback and the multi_stream_obs denominator. Both need a fixture out of proportion to a provably equivalent rewrite.

Two real defects fell out

1. spatial_density.rs — the -inf diagnostic tested (rate <= 0.0 && flow > 0) || (flow > 0), which collapses to flow > 0. The pathology the author wanted to see (flow out of a transition with no propensity) was printed but never distinguished. Same rows, now marked.
2. Three orphaned doc comments — apply_params_file lost its docs to a function inserted between them (reattached); sampling.rss module overview used ///, so it documented a use statement (now //!); and a doc block for the removed --starts-from flag outlived it (deleted).

Design calls to sanity-check

Allowed workspace-wide, each with its reason in rust/Cargo.toml:

lint	why
needless_range_loop	the one that matters. All remaining sites are pgas/pmmh/nuts/ode/resampling, where the index mirrors the derivation and often walks several arrays at once. De-indexing buys no correctness and makes a silent transposition easier to introduce — CLAUDE.md flags these exact files as high-risk "regardless of how mechanical the change looks".
too_many_arguments, type_complexity	numerical kernels where the parameter list is the domain
upper_case_acronyms	PGAS/PMMH are the method names
large_enum_variant	boxing argv-built dispatch enums

approx_constant is allowed at four call sites where it is a false positive: 3.14 is not π, and substituting the constant would change what the test asserts. One is a scipy oracle value that happens to equal -ln(2).

No correctness lint is silenced anywhere.

Commits

items_after_test_module produced an ~800-line reordering in trajectories.rs and pmmh.rs. It is in its own commit, verified as a pure move by comparing whitespace-normalized sorted line sets against main (diff empty), so it does not bury the substantive changes.

Verification

Full make test — every phase, ending with the install-script suite — exit 0, 0 failures.