ci: add cargo fmt + clippy + test workflow

[protosphinx]

Summary

jsonic has 118 inline unit tests (61 + 57 across the protocol crates) but no CI to gate them. Every PR has relied on the author running `cargo test` locally.

This wires the three standard cargo gates plus the drive-by fixes needed for the first CI run to be green. `-D warnings` is intentionally NOT enforced on clippy — see below.

What landed

1. `.github/workflows/ci.yml` — three jobs: `cargo fmt --all -- --check`, `cargo clippy --all-targets` (no `-D warnings`), `cargo test --all-targets`. `clippy`/`test` `needs: fmt`. Toolchain stable; cache via `Swatinem/rust-cache@v2`.

2. Drive-by hygiene so the first run is green:

   • `cargo fmt` applied (whitespace only).
   • `src/core/reputation.rs`: doc comment list-item continuation lines re-indented to satisfy `clippy::doc_overindented_list_items`.
   • `src/core/crypto.rs`: replaced `&[h.clone()]` with `std::slice::from_ref(&h)` per `clippy::cloned_ref_to_slice_refs` (behaviour-equivalent — `merkle_root` only reads the slice).

About the missing -D warnings

`jsonic-demo` (the bin target) carries 26 pre-existing dead_code + naming-convention warnings (unused trait / struct / method names, capitalised acronym `DAO`). Cleaning those up should be a deliberate backlog burn-down, not piggybacked onto the CI-wiring PR. Tighten clippy to `-D warnings` once that backlog is resolved.

Verification

• `cargo test --release` → 118 passed (61 + 57)
• `cargo fmt --all -- --check` → clean
• `cargo clippy --all-targets` → succeeds (warnings visible in logs)

Test plan

• CI fmt + clippy + test all pass on this PR
• Future regressions get caught before merge
• Follow-up: pay down the 26 dead_code warnings, then enable `-D warnings` in this workflow