Stabilize final gate before release checkpoint

Resolve the G012 evidence gate by fixing permission-mode regressions, platform-sensitive tests, and the clippy surface that blocked an all-targets verification run.

Constraint: G012 final gate required docs, board, full workspace tests, and clippy -D warnings evidence before checkpointing.

Rejected: documenting the worker-2 gate failure as an accepted gap | the failing tests and lints were locally reproducible and fixable.

Confidence: high

Scope-risk: moderate

Directive: Preserve read-only permission requirements for read/glob/grep tools; write/edit remain workspace-write or danger-full-access when outside the workspace.

Tested: python3 .github/scripts/check_doc_source_of_truth.py; python3 .github/scripts/check_release_readiness.py; python3 scripts/validate_cc2_board.py --board .omx/cc2/board.json; python3 .omx/cc2/validate_issue_parity_intake.py .omx/cc2/issue-parity-intake.json; cargo fmt --manifest-path rust/Cargo.toml --all -- --check; cargo check --manifest-path rust/Cargo.toml --workspace; cargo test --manifest-path rust/Cargo.toml --workspace -- --nocapture; cargo clippy --manifest-path rust/Cargo.toml --workspace --all-targets -- -D warnings

Not-tested: live network provider smoke tests and remote PR/issue mutations.

rust/crates/runtime/src/policy_engine.rs

@@ -186,6 +186,7 @@ pub struct PolicyEvaluation {
     pub events: Vec<PolicyDecisionEvent>,
 }
 
+#[allow(clippy::struct_excessive_bools)]
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LaneContext {
     pub lane_id: String,
@@ -730,6 +731,7 @@ mod tests {
     }
 
     #[test]
+    #[allow(clippy::duration_suboptimal_units, clippy::too_many_lines)]
     fn executable_decision_table_emits_retry_rebase_merge_escalate_cleanup_and_approval_events() {
         let engine = PolicyEngine::new(vec![
             PolicyRule::new(

rust/crates/runtime/src/session_control.rs

@@ -163,6 +163,7 @@ impl SessionStore {
         })
     }
 
+    #[must_use]
     pub fn session_exists(&self, reference: &str) -> bool {
         self.resolve_reference(reference).is_ok()
     }