ci: enforce no panics in production code

[ilblackdragon]

Summary

• Add a no-panics CI job to code_style.yml that diffs the PR against the base branch and blocks .unwrap(), .expect(), assert!(), assert_eq!(), assert_ne!() in src/ and crates/ production code
• Add pre-commit hook check 6 (PANIC) to pre-commit-safety.sh catching the same patterns in staged diffs
• Extend check-boundaries.sh Check 2 to also detect assert!() variants

All checks exclude debug_assert (compiled out in release), test annotations (#[cfg(test)], #[test], mod tests), and lines with // safety: <reason> suppression comments.

Test plan

• Verify CI no-panics job passes on this PR (no production panic calls in the diff)
• Test pre-commit hook locally: stage a file with .unwrap() in non-test code and confirm it blocks
• Confirm // safety: <reason> suppression works for legitimate uses
• Run bash scripts/check-boundaries.sh and verify Check 2 now reports assert!() calls

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[zmanian]

This PR targets main but appears to be branched from staging, pulling in all staging commits (54 commits, diff too large for GitHub to render).

Should this target staging instead? The actual new content seems to be just the no-panics CI job, pre-commit hook check, and check-boundaries.sh update. Targeting staging would make this much easier to review.

[zmanian]

Clean and well-scoped. Three changes that all serve the same purpose:

1. CI job (no-panics): Diffs against base SHA, catches .unwrap(), .expect(), assert!() in src/ and crates/ added lines. Properly excludes debug_assert, test annotations, and // safety: suppressions. Wired into the code-style roll-up gate.

2. check-boundaries.sh: Extends Check 2 to also catch assert!() variants with the same exclusions.

3. pre-commit-safety.sh: Adds Check 6 matching the same patterns in staged diffs.

The // safety: <reason> escape hatch is the right approach for legitimate uses (e.g., after infallible operations). The grep patterns correctly use [^_]assert to avoid matching debug_assert.

One minor note: the CI job's grep filters on added lines (^\+[^+]) then excludes lines containing #[test] or mod tests. This works for inline test annotations but won't catch if a .unwrap() is added inside a #[cfg(test)] mod tests { ... } block where the mod tests line itself wasn't in the diff. In practice this is fine since the pre-existing test module boundary won't appear in the diff -- only new unwraps will, and those in test functions will have #[test] nearby. Non-blocking.

LGTM