Finish #974 tail: dylint violation cleanup (#964) + cold-pipeline overlap (#953)

[zackees]

Handoff for the last two open sub-issues of #974 (ESP32 cold/warm build perf + CI hygiene). Four of the six sub-issues are resolved+merged (#970, #966 incl. #986, #954, #960). This issue captures the exact remaining state of the last two so the work can resume cleanly.

#964 — dylint job green + lints enforcing

Done (pushed): PR #989, branch fix/964-dylint-link, commit 4984b38a. Root cause found + fixed: only ban_std_pathbuf had .cargo/config.toml with rustflags = ["-C", "linker=dylint-link"]; the other 24 dylint crates lacked it, so cargo-dylint 5.0.0 emitted bare <name>.so instead of <name>@<toolchain>.so, couldn't find the libs, and the alias-loop workaround never converged → no custom lints enforced. Added the config to all 24. Verified in CI: all 25 lint libraries now build with the @toolchain suffix and actually run (the alias loop no longer even fires).

Remaining: now that the lints run for the first time, they catch real accumulated violations, so the Dylint check on #989 is still FAILURE. Must fix genuine violations / allowlist intentional ones until dylint is zero-error workspace-wide. Known so far (dylint stops at the first crate with errors — there may be more beyond fbuild-packages):

• ban_manual_slash_normalize: hand-rolled .replace('\', "/") — fix to fbuild_core::path::NormalizedPath::display_slash(). Notably in object_hash_key in crates/fbuild-packages/src/library/library_compiler.rs and crates/fbuild-build/src/compiler.rs (both landed via fix(build): ESP32 sketch+core compiles hit zccache cross-project (#966) #985's cross-project cache-key work).
• ban_raw_path_prefix_compare: raw Path::strip_prefix compares that can feed a cache key — normalize via fbuild_core::path::normalize_for_key/NormalizedPath, or allowlist in dylints/ban_raw_path_prefix_compare/src/allowlist.txt with a one-line reason when not cache-key-feeding.
• ban_std_pathbuf: several std::path::PathBuf uses (incl. new crates/fbuild-packages/src/library/esptool.rs) — allowlist per-file with reasons, or switch to NormalizedPath where genuinely a normalized path.

Local dylint repro recipe (fast iteration beats ~15-min CI rounds), inside the fbuild-profile-linux container:

• Container is missing libssl-dev → apt-get update && apt-get install -y libssl-dev pkg-config.
• soldr toolchain lives at /root/.soldr: set RUSTUP_HOME=/root/.soldr/rustup CARGO_HOME=/root/.soldr/cargo and PATH=/root/.soldr/bin:/root/.soldr/cargo/bin:$PATH (confirm the actual rustup home under /root/.soldr first).
• rustup toolchain install nightly-2026-03-26 --component rustc-dev,llvm-tools-preview --profile minimal
• cargo install cargo-dylint dylint-link --version 5.0.0 --locked
• uv run python ci/build_dylint_driver.py
• cargo dylint --all -- --workspace --all-targets ← should reach zero errors when done.

Then push to fix/964-dylint-link; the Dylint check on #989 must go green. Do not weaken/disable any lint or blanket-allowlist directories.

#953 — cold-pipeline overlap

State: worktree branch fix/953-cold-overlap (not pushed). clippy + lib tests were green; was mid cold-build A/B profiling and not yet proven to reduce the ~185–237 s pioarduino-resolve phase. #967 already overlapped toolchain∥framework downloads via tokio::join!; the remaining candidates are: fold the platform download into that join, overlap extract with the next download, overlap lib_deps library download with resolve, and start fw-libs compile before resolve fully completes.

Remaining: finish the cold-build A/B (cold = fresh ~/.fbuild + ~/.platformio, run twice per side for network variance; read the pioarduino-resolve / total phase timings from the daemon.log config-parse perf line). Ship only if there's a measurable, real reduction with the build still exit 0 and no cache-dir races; otherwise document the numbers and close as diminishing-return. Validation container invocation and details are in the original #953 body.

Close-out

When #964's Dylint check is green (admin-merge PR #989) and #953 is either merged or closed with numbers, close the parent #974.

[zackees]

Closed after completing the #974 tail work tracked here.

Dylint cleanup / #964:

• Shipped and merged fix(dylint): clean up violations after dylint-link rollout #991: fix(dylint): clean up violations after dylint-link rollout #991
• Merge commit: 4fbe3f5
• Addressed CodeRabbit follow-up by adding the Windows HOME fallback in lpc_debugger_reflash::home_dir() and direct coverage for normalized_path_is_under.
• ci(dylint): Dylint job is red on main — alias-loop workaround fails, so NO custom lints are enforced #964 is closed.

Local validation for the merged dylint cleanup:

• Windows: soldr --no-cache cargo build -p fbuild-cli -p fbuild-deploy --message-format=short passed.
• Docker Linux: soldr toolchain ensure && soldr --no-cache cargo build -p fbuild-cli -p fbuild-deploy --message-format=short passed in the Linux build container.
• Targeted follow-up tests also passed locally: fbuild-cli normalized_path_is_under, fbuild-deploy lpc_debugger_reflash, soldr cargo fmt --all, and git diff --check.

Cold-pipeline overlap / #953:

• Rebased the candidate on current origin/main and validated it locally with fmt, targeted package tests, cargo check, and diff check.
• Measured cold profiles against main and candidate:
  • Baseline main median: 855.1s (907.43s, 802.80s)
  • Candidate median: 903.5s (863.97s, 943.01s)
• The candidate did not meet the expected improvement and regressed median runtime, so perf(packages): overlap download/extract/install in cold pioarduino-resolve (~185-237s serialized) #953 was closed as not planned with the measurement details.

CI note:

• PR fix(dylint): clean up violations after dylint-link rollout #991 was merged. All PR checks passed except the rerun of Check (windows-latest), which again hit the 30-minute GitHub job limit and was cancelled while still in the full-workspace Check phase. The log ended with normal dependency/workspace checking followed by The operation was canceled; the touched crates were confirmed locally on Windows and Docker Linux as listed above.