Convert the static-check shell libraries to Rust

[thedavidmeister]

The org's static checks are accumulating as bash-in-composite-actions plus lib/*.sh sourced scripts (no-ignored-tests, no-custom-natspec, sol-single-contract, check-rainix-flake-pin in #252). Bash grep pipelines are fragile in exactly the ways that have already bitten: quoting/escaping bugs, exclusion anchoring subtleties (--exclude-dir=lib hiding test/lib/), and classification-by-grep misreads. Precedent for the fix: issue-pr-cron's pr-review-report was rewritten in Rust (fixing 16 reviewed bugs) and its queue sort was folded in with full mutation-validated test coverage (37/37 mutants killed).

Task: one Rust binary (a rainix crate, built via the existing rust toolchain in the flake) exposing the static checks as subcommands (e.g. rainix-static no-ignored-tests, rainix-static no-custom-natspec, rainix-static sol-single-contract); composite actions invoke it instead of inline bash; behaviors ported 1:1 with the existing BATS fixtures translated into Rust tests (and mutation-validated); BATS suites retire only as each subcommand reaches parity. Root-anchored vendor exclusion and exact-form allowlists (ERC-7201) preserved verbatim.

🤖 Generated with Claude Code

[thedavidmeister]

Foundation landed via #256: the rainix-static crate now exists (nix package, tests run in-build via doCheck, cachix-cached, composite invokes it at the pinned RAINIX_SHA) with no-submodules as the first subcommand. Remaining migrations are now incremental: port no-ignored-tests, no-custom-natspec, and sol-single-contract as sibling subcommands (behaviors 1:1 from the BATS fixtures, mutation-validated per QA-GUIDE.md), flip each composite to nix run, retire its bash+BATS when parity is proven.

[thedavidmeister]

🤖 ai:assistant

Architecture correction (2026-07-05): NO thin bash wrappers. Each check ships as a rainix-static subcommand and the composite invokes it via nix run DIRECTLY (already the pattern for no-submodules in #256/#258) — the old .sh + BATS retire entirely, no wrapper .sh remains. A wrapper is still untested bash.

[thedavidmeister]

🤖 Coverage note (David-directed 2026-07-10): fold sol-pragma-convention into this binary too. PR #251 implemented it as shell + BATS and was rejected for exactly that reason (issue #250) — it's another rainix-static subcommand (rainix-static sol-pragma-convention): ^ for lib/abstract, = for concrete incl. concrete test mocks; skip generated/dependencies; edge cases empty-workaround→= and bare/>= unsupported; BATS→cargo tests, mutation-validated.

So the full de-bash set for this binary is: no-ignored-tests, no-custom-natspec, sol-single-contract, check-rainix-flake-pin, sol-pragma-convention (+ the #257 org-health signal subcommands). #250 tracks the pragma WHAT; this issue is the shared Rust HOW.