chore(bazel): generated clippy config from workspace lints at release time

- Added scripts/gen-clippy-bazelrc.ts: emits bazel/clippy.bazelrc from
  [workspace.lints] in Cargo.toml (groups by ascending priority, then
  per-lint overrides, alphabetical within each tier); --check mode
  verifies sync without writing.
- release.ts regenerates it alongside the lockfiles; the release_gate CD
  job runs the --check so drift only blocks publishing, never ordinary
  CI. Added the gen:clippy package script.

.github/workflows/ci.yml

@@ -465,6 +465,13 @@ jobs:
       needs: [release_metadata, check, rust_validate, native_addons, test_workspace, test_coding_agent_singleton, test_ts_native, test_coding_agent_ui, test_coding_agent_runtime, test_coding_agent_native, test_smoke, install_methods]
       runs-on: ubuntu-22.04
       steps:
+         - uses: actions/checkout@v4
+         - uses: ./.github/actions/bun-install
+         # Generated-config drift gate: bazel/clippy.bazelrc is maintained by
+         # scripts/release.ts (like the lockfiles); a stale file only blocks
+         # publishing, never ordinary CI.
+         - name: Check generated clippy config
+           run: bun scripts/gen-clippy-bazelrc.ts --check
          - run: echo "release validation green"
 
    # Builds (does not publish) the Linux-hosted release binaries in parallel