ci: enforce clippy -D warnings and cargo audit as hard gates

Flip both CI gates from informational to hard-fail (SPEC-001 quality gates):
- clippy: `-- -D warnings` on the server crate. Cleared the debt via clippy --fix
  (unused imports/style), targeted #[allow(dead_code)] on native-remote-control
  future API, and #[allow(clippy::too_many_arguments)] on 3 protocol-mirroring fns.
- cargo audit: hard-fail with documented per-ID --ignore flags (rsa RUSTSEC-2023-0071
  unfixable/unreachable in active tree; gtk-rs + glib Linux-only tray backend not
  compiled into the Windows agent; proc-macro-error build-time). New advisories fail.
- Move [profile.release] to the workspace root (it was silently ignored in the server
  member), activating lto/codegen-units/strip.

No behavioral changes. Reviewed and gates verified passing on the build host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/relay/mod.rs

@@ -288,6 +288,7 @@ pub async fn viewer_ws_handler(
 }
 
 /// Handle an agent WebSocket connection
+#[allow(clippy::too_many_arguments)] // signature mirrors the relay/session protocol contract; refactor into a params struct tracked in docs/specs/native-remote-control/
 async fn handle_agent_connection(
     socket: WebSocket,
     sessions: SessionManager,
@@ -318,7 +319,7 @@ async fn handle_agent_connection(
             };
             let mut buf = Vec::new();
             if prost::Message::encode(&disconnect_msg, &mut buf).is_ok() {
-                let _ = ws_sender.send(Message::Binary(buf.into())).await;
+                let _ = ws_sender.send(Message::Binary(buf)).await;
             }
             let _ = ws_sender.close().await;
             return;
@@ -335,7 +336,7 @@ async fn handle_agent_connection(
     info!("Session created: {} (agent in idle mode)", session_id);
 
     // Database: upsert machine and create session record
-    let machine_id = if let Some(ref db) = db {
+    let _machine_id = if let Some(ref db) = db {
         match db::machines::upsert_machine(db.pool(), &agent_id, &agent_name, is_persistent).await {
             Ok(machine) => {
                 // Create session record
@@ -401,11 +402,7 @@ async fn handle_agent_connection(
     let input_forward = tokio::spawn(async move {
         while let Some(input_data) = input_rx.recv().await {
             let mut sender = ws_sender_input.lock().await;
-            if sender
-                .send(Message::Binary(input_data.into()))
-                .await
-                .is_err()
-            {
+            if sender.send(Message::Binary(input_data)).await.is_err() {
                 break;
             }
         }
@@ -435,7 +432,7 @@ async fn handle_agent_connection(
                     let mut buf = Vec::new();
                     if prost::Message::encode(&disconnect_msg, &mut buf).is_ok() {
                         let mut sender = ws_sender_cancel.lock().await;
-                        let _ = sender.send(Message::Binary(buf.into())).await;
+                        let _ = sender.send(Message::Binary(buf)).await;
                         let _ = sender.close().await;
                     }
                     break;
@@ -651,11 +648,7 @@ async fn handle_viewer_connection(
     // Task to forward frames from agent to this viewer
     let frame_forward = tokio::spawn(async move {
         while let Ok(frame_data) = frame_rx.recv().await {
-            if ws_sender
-                .send(Message::Binary(frame_data.into()))
-                .await
-                .is_err()
-            {
+            if ws_sender.send(Message::Binary(frame_data)).await.is_err() {
                 break;
             }
         }