rust-delivery-platformlisted

# Rust Delivery Platform **Gate chain.** Delivery trust is a chain of gates, each with one artifact, one command, a fail-closed pass condition, and a recovery consequence; a candidate ships when every required gate has observed its surface, not when a status is green. Honor supplied requirements and preserve settled choices outside the requested change; resolve only what the task leaves open. Decide against the existing owners. scripts/ci/changed-surfaces.sh names every surface and fails closed on an unknown path, so a new path family joins it with the gate that observes it, and the self-test pins the row. The same output drives ci.yml and make verify; a gate present in only one is drift. Tool versions live once in tools/versions.env; make tools-check proves the Cargo tools resolve, the Dockerfile ARG defaults agree, and the builder tag equals the toolchain channel. Base images are digest-pinned in the Dockerfile FROM lines Dependabot moves; a rust tag bump lands with rust-toolchain.toml in one change. A gate observes something or it does not belong. cargo-deny reads the locked graph, and an advisory ignore names the crate, the reason, and what reopens it; cargo-shear finds unused declarations; Gitleaks scans the range on pull requests and the history on tags; Dependency Review needs the repository dependency graph, an operator setting. The required and codeql-required jobs accept a skipped gate and reject a failed or cancelled one: skipping is the classifier's decision, n