Dylint CI gate is red on main (driver build_library failure) — lints are not enforcing

[zackees]

Problem

The Dylint workflow has failed on every push to main for at least the last 5 runs (e.g. run 28569368924 on chore(release): … bump 2.3.23 -> 2.3.24). The failure is infrastructure, not a lint finding:

Stack backtrace:
   0: anyhow::error::<impl anyhow::Error>::msg
   1: dylint::library_packages::build_library
   ...
   5: dylint::run_with_name_toolchain_map
   6: dylint::run

followed by the workflow's @<toolchain> alias-creation retry loop exhausting its attempts:

::error::cargo dylint did not succeed after ${max_attempts} attempts

Consequence — this is not cosmetic

A red gate is zero enforcement. Concrete escape: #935 merged crates/fbuild-deploy/src/probe_rs.rs with two raw std::process::Command::output() calls — exactly the pattern ban_raw_subprocess (#264) exists to block, in a file that is not in its allowlist. The result on Windows was a visible console window flashing on the user's screen during every LPC845 SWD deploy (daemon is windowless → raw console-subsystem child allocates a fresh console), plus no timeout on a probe family famous for wedging. Fixed after the fact in #938.

Every merge while this gate is red can add more of these silently.

Ask

1. Fix the driver build (dylint::library_packages::build_library — likely the pinned nightly-2026-03-26 toolchain / component set vs cargo-dylint 5.0.0 interaction, or the alias workaround no longer matching what dylint expects).
2. Once green, run the full suite over the workspace and burn down any violations that accumulated while the gate was red.
3. Consider making the Dylint workflow a required status check so a red run blocks merges instead of scrolling past.

Refs

• fix(deploy): probe-rs spawns via run_command_blocking — no console flash, 120s timeout #938 — the probe-rs fix for the violation that escaped
• ban_raw_subprocess dylint: enforce wrapper for all subprocess spawns #264 — ban_raw_subprocess
• probe-rs LPC-Link2 v1.0.7: push through all blockers end-to-end, single-shot #935 / probe-rs (fork): replace hidapi with nusb for CMSIS-DAP v1 HID transport — the actual fix for touchless LPC-Link2 deploy #936 — the PR that merged through the red gate