[mblua]

Closes #3231

Continues batch 11 (#3227, PR #3230, merged as 14cd839).

Batch 12 of the Rust sanitizing campaign. It implements the first step of the batch 10 design proposal G06 (symptom 06, infrastructure outside the edge) and removes two stale gate 09 allowlist entries. No security, authority, ordering, cfg, IPC or public API change. It does not touch files reserved by #3198, #3199 or the cut issues.

Changes

• 06 S1, Repos rules (room-31, 928c503): new pub(crate) module src-tauri/src/repos.rs with the pure rules derive_repo_name and strip_userinfo, moved literally from commands/repos.rs. commands::repos keeps derive_repo_name through an internal re-export. The two URL tests moved to repos/tests.rs without changing asserts, and new tests cover derive_repo_name. repos depends only on std.
• 06 S2, gate regression (room-31, 72274c4): the gate 06 had a real gap: a new core file using Tauri only under cfg(test) passed. The gate now checks test tokens of new files with the same alias resolver. New regression fixtures cover direct use, aliases, cfg(test) and inner cfg. Production counters do not change.
• 09 allowlist cleanup (room-34, 5613015): removed the stale launch_files entries for config/agency_cache.rs (its Command sites moved to process.rs in batch 11) and config/agency_cache/git.rs (the site exists but is already in the base, so the entry accepted nothing). No other entry changed.
• Census (room-36, 4ceeb6c): c4_state_key_census 1281 → 1283 (repos.rs, repos/tests.rs). spawn_search_path_inventory unchanged: the new files launch nothing.

Measurements (0176550 → 4ceeb6c)

Symptom	Measure	Before	After
06	Pure rules defined in commands/repos	2	0
06	URL tests at the edge / in the core	2 / 0	0 / 2
06	Production files with Tauri / emit / state outside the edge	94 / 24 / 61	94 / 24 / 61
06	Uses Tauri / emit / state+try_state	701 / 35 / 344	unchanged
06	Regression for new core node (direct, alias, cfg(test))	absent	present
09	Gate 09 stale allowlist WARN	2	0
09	Gate 09 sites (launch/env read/env write)	19 / 26 / 0	19 / 26 / 0

Verification (room-35, Windows, 4ceeb6c)

• cargo fmt --check, cargo clippy --all-targets -- -D warnings: pass.
• cargo test --lib: 6604 passed, 0 failed, 30 ignored.
• cargo test --test '*' --no-fail-fast: 321 passed, 0 failed, 6 ignored (30 binaries, census included).
• The eight sanitizing:* gates (--base-ref 0176550), sanitizing:self (69/0/0), test:debt, check:arcs (2949), check:cycles (0 new), check:served-paths, cog:scan, cog:baseline: pass.

Known red gates

None known.

Known warnings (not blocking, deferred)

• Scanner ambiguity warnings in gates 05/07/04 (glob imports, untyped receivers, unclassified writers) and 38 concat! WARN in check:served-paths, same as batch 11.

Rooms

• room-31: G06 S1+S2
• room-34: gate 09 allowlist cleanup
• room-36: census
• room-35: full verification

Files modified

• sanitizing.allowlist.json
• scripts/sanitizing_tauri_edge.mjs
• scripts/sanitizing_tests.mjs
• src-tauri/module-arcs.txt
• src-tauri/src/commands/repos.rs
• src-tauri/src/commands/repos/tests.rs
• src-tauri/src/lib.rs
• src-tauri/src/repos.rs
• src-tauri/src/repos/tests.rs
• src-tauri/tests/c4_state_key_census.rs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud