Code quality pass: streaming hashing, permit hygiene, eval state guard, CLI cleanup

Summary

A principal-engineer-style code-quality pass over the four crates. Four focused commits, each with regression tests, none changing CLI surface.

• refactor(cas): add a streaming Digest::of_reader so input hashing is bounded-memory regardless of file size, and clean up leaked scratch/stream-* files when put_stream errors mid-stream.
• fix(core): Runner::run was acquiring the Semaphore permit before checking the action cache, so concurrent cache hits queued behind real subprocess slots. Lookup is now outside the permit, with a re-check under the permit to keep parallel writers consistent.
• fix(frontend): the per-thread Starlark STATE was set/cleared by hand, so a panic between install and take() would leak the slot into the next call. Replaced with a StateGuard whose Drop unconditionally clears.
• refactor(cli): centralize the .fabrik literal behind CACHE_DIR, fold the eight-arg exec() into an ExecArgs struct (drops the too_many_arguments allow), split tool_env into a pure select_tool_env(vars) filter, and switch input_digest to the new streaming hasher. Adds the previously-missing unit-test module for run.rs internals (env filtering, source_path escapes, input_digest stability and content-sensitivity, action shape per target kind, unsupported-kind rejection).

Net test delta: +14 Rust tests (72 → 86). Shellspec is unchanged at 50 examples, all still passing.

Testing

• mise exec -- cargo test --workspace --all-targets — 86 passed
• mise exec -- cargo clippy --workspace --all-targets -- -D warnings — clean
• mise exec -- cargo fmt --all -- --check — clean
• mise exec -- cargo build --release — succeeds
• mise exec -- shellspec — 50 examples, 0 failures

No GitHub comments yet.