Fix workspace-lint violations across the installer

[leynos]

Summary

This branch clears the installer's share of the workspace-lint violations, staying green under the current gates while pre-emptively satisfying the stricter configuration landing later in the stack. Most of the diff is mechanical — checked indexing, by-reference parameters, descriptive errors in place of panics — but several API changes land here because the fixes require them, and they are the parts worth reviewing carefully.

Fifth PR in the lint-hardening stack, based on harden-lint-support-crates.

Review walkthrough

• Start with installer/src/dirs.rs: the BaseDirs trait methods drop their redundant suffixes (home_dir → home, bin_dir → executables, whitaker_data_dir → whitaker_data). The external directories_next::UserDirs::home_dir() call inside the implementation deliberately keeps its own name.
• installer/src/cli.rs introduces the LintSelectionFlags/ExecutionFlags/SkipFlags clap flatten groups, so no single struct carries an excess of booleans; 36 call sites follow.
• installer/src/deps/install_repository.rs is the one new module: the repository-release install path extracted from install.rs, with executor, tool, and dependency grouped into a RepositoryInstallRequest so the extraction stays within the four-argument budget rather than trading one lint for another.
• installer/src/install_metrics.rs reports integer permille instead of a float rate, so assertions compare exactly rather than within a tolerance; the feature file wording follows.
• installer/tests/behaviour_staging.rs swaps unsafe { libc::geteuid() } for rustix::process::geteuid(), removing the last unsafe block in the installer — and libc with it.

Validation

• make check-fmt lint typecheck: pass. make lint runs cargo doc --workspace, which caught stale intra-doc links and no_run doctests referring to the renamed BaseDirs methods.
• make test: 1652/1652 passed, 5 skipped.

Notes

• A #[expect(clippy::cast_sign_loss)] is removed rather than retained: the timestamp arithmetic it covered now uses div_euclid/rem_euclid and a checked conversion. No #[allow] or #[expect] is added anywhere in this branch.
• make markdownlint reports MD012 in docs/developers-guide.md; that is pre-existing on the parent branch and untouched here — its fix belongs to a PR above this one.
• The stack: test-quality sweep → spelling → module structure → support-crate lint fixes → installer lint fixes → rustfmt profile → lint configuration → whitaker self-linting gate.

References

• Lody session: https://lody.ai/leynos/sessions/72ffeb19-63b7-4202-ad25-9bf07e8edde6

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}