Release gate 4 — remove tracked Rust artifacts and establish native hygiene

[M9nx]

1. Problem / evidence

On main (f1cd131):

• git ls-files codexa-core/target | wc -l → 1694 tracked build-output files, although the path is ignored.
• Local pack size: 120.53 MiB (git count-objects -vH).
• No CI job runs cargo fmt, clippy, tests, or audit for codexa-core.
• Rust Dependabot PRs chore(deps): bump serde_json from 1.0.149 to 1.0.151 in /codexa-core #87–chore(deps): bump regex from 1.12.3 to 1.13.1 in /codexa-core #91 show green ci-required with zero Rust validation; chore(deps): bump tantivy from 0.22.1 to 0.26.2 in /codexa-core #88 (tantivy 0.22.1 → 0.26.2) and chore(deps): bump ort from 2.0.0-rc.12 to 2.0.0-rc.13 in /codexa-core #90 (ort 2.0.0-rc.12 → rc.13) touch optional features.

2. Outcome

No generated codexa-core/target content is tracked, a guard prevents regressions, and native changes get native validation.

3. Scope

codexa-core/target/ (removal from index only), .gitignore, a lightweight tracked-output guard, codexa-core/src/** (rustfmt only), Rust CI job (with Release gate 2).

4. Non-goals

• No history rewrite (separate, explicitly approved operation).
• No functional Rust changes in the formatting PR.

5. Dependencies

Rust CI PR coordinates with Release gate 2 PR 4. Dependabot #87–#91 wait for this.

6. PR breakdown

1. chore(repo): stop tracking codexa-core build output — git rm -r --cached codexa-core/target; confirm ignore; CI guard that fails if build/cache output is tracked.
2. style(rust): apply and enforce rustfmt — formatting only.
3. ci(rust): enforce fmt, clippy, tests, and audit.
4. ci(rust): exercise promoted optional features — at minimum default, Tantivy, ONNX paths that docs/release claim.

7. Acceptance criteria

• git ls-files codexa-core/target returns nothing.
• A clean Rust build recreates artifacts only as ignored local state.
• fmt / clippy / test / audit pass from a clean checkout.
• chore(deps): bump serde_json from 1.0.149 to 1.0.151 in /codexa-core #87, chore(deps): bump tree-sitter-rust from 0.24.0 to 0.24.2 in /codexa-core #89, chore(deps): bump regex from 1.12.3 to 1.13.1 in /codexa-core #91 re-evaluated with native evidence; chore(deps): bump tantivy from 0.22.1 to 0.26.2 in /codexa-core #88 and chore(deps): bump ort from 2.0.0-rc.12 to 2.0.0-rc.13 in /codexa-core #90 merged only after feature-specific checks and migration review.
• Repository size impact reported; history rewrite remains out of scope.

8. Risks and rollback

Removing tracked files is a large diff but zero runtime impact. Developers with local target/ keep their files (only index removal). Rollback: revert.

9. Evidence to attach

Before/after git ls-files counts, clean-build output, Rust CI run URLs, per-feature test logs.

10. Labels, milestone, estimate

Labels: rust, enhancement. Milestone: v0.5.1 Release Readiness. Estimate: 2–3 days.