Feat/add rustfmt clippy ci

[AndyGauge]

fixes #837

Runs rustfmt and clippy in CI so the project's formatting expectations are
enforced automatically, instead of maintainers pointing them out by hand in
review (as in #836).

What runs in CI

A new CI workflow with a single lint job:

- cargo fmt --all -- --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo xtask fmt-md --check

Tests, spellcheck, and link checking stay where they already live
(mdbook-test.yml, spellcheck.yml, check-links.yml) rather than being
duplicated here.

Formatting the inline markdown examples

The skeptic-tested examples are written directly inside src/**/*.md, so
cargo fmt never sees them. cargo xtask fmt-md (new,
xtask/src/fmt_md.rs) extracts each fenced block, runs rustfmt at the
edition named by the fence, and writes the result back — preserving the
file's existing line endings, since part of the book is checked in as CRLF.
--check reports instead of rewriting.

Of 283 blocks scanned, 126 were reformatted and 66 skipped:

Skipped	Why
47	{{#include}} of a workspace crate — already covered by cargo fmt --all
14	ignore blocks — not compiled by skeptic, need not be valid Rust
5	contain skeptic # hidden lines

The hidden-line blocks are left for a human on purpose. rustfmt reflows long
lines, so a hidden line that gets split would keep its # marker on only one
fragment — silently unhiding code in the published book. fmt-md reports them
by name rather than guessing.

Formatting the workspace shifted line numbers that three {{#include ...rs::N}}
anchors depend on, so those were recomputed (actor_pattern 168→163, reload
54→57, exif 23→29) and the rendered HTML checked to confirm each block still
ends at main's closing brace.

Clippy findings

Fixed rather than suppressed:

• crates/web/src/links.rs — drop a no-op .into_iter()
• crates/web/src/broken.rs — Iterator::next over .nth(0)
• xtask/src/tests.rs — io::Error::other in place of io::Error::new(ErrorKind::Other, _)
• heapless_alloc.rs — 3.14 was an arbitrary sensor reading, not π, so it now
  uses a value that reads as a real measurement

Two are allowed per-crate, where the flagged code is the example:

• manual_map in no_panic — the doc comment teaches exhaustively handling
  every path, which is what the spelled-out match shows
• result_large_err in figment — figment::Error is 208 bytes by upstream
  design, and boxing it would only obscure the example's error handling

Also

Makefile gains fmt, fmt-check, and lint targets; CLAUDE.md documents
cargo xtask fmt-md.