PB-071: Run the Rust tests in CI

State: Proposed. Not approved for implementation. Priority: P1 (mandatory: required). Owner when approved: Master product (unassigned; recommend Enterprise readiness, FD-103).

1. PR title and ID#

Run cargo test for the desktop shell in CI (PB-071)

2. Business problem#

The Rust shell holds the code that keeps the app responsive and safe: the engine watchdog, update integrity checks, the update policy switch and the saved Fabric sign-in cookies. It has unit tests, but no workflow runs them, so a regression in any of these ships unnoticed.

3. Current verified behavior#

• app/src-tauri/src/watchdog.rs has a tests module with five tests; main.rs has policy_tests, the sign-in cookie tests and the integrity tests (hashes_a_file_as_lowercase_hex, checksum acceptance and refusal, windows_tools_run_from_system32).
• .github/workflows/ci.yml job shell runs cargo build --release --locked on windows-latest; no job runs cargo test.
• In this assessment cargo test could not build on Linux (gdk-3.0 missing), so the tests' current pass or fail state is unknown.

4. Desired behavior#

Every pull request and push runs the Rust unit tests on Windows, and a failure fails CI.

5. In scope and out of scope#

In scope: a cargo test --locked step in the existing shell job (or a new job), fixes for any test that fails today, a note in CONTRIBUTING.md.

Out of scope: new Rust tests beyond fixing failing ones; Linux or macOS shell builds; changes to signing, release or cache rules.

6. Architecture and files#

• .github/workflows/ci.yml: add cargo test --locked before cargo build --release --locked in shell, reusing the toolchain and the existing read-only-on-PR cache.
• app/src-tauri/src/*.rs: only if a test fails.
• CONTRIBUTING.md: how to run the Rust tests locally on Windows.

7. Functional requirements#

• The step runs on pull_request and push to main.
• It runs with no secrets and no signing variables.
• Its failure blocks the release job (which already needs: shell).

8. Nonfunctional requirements#

• Adds no more than a few minutes to the shell job thanks to the shared cache.
• Uses only SHA-pinned actions already in the workflow.

9. Dependencies#

None. PB-008 and PB-072 depend on this.

10. Security and compatibility#

• The step must run before the signing step and must not change the save-if cache rule, so a pull request still can't seed release builds.
• No new permissions in the workflow.

11. Acceptance criteria#

• CI on the PR shows cargo test running and passing on windows-latest.
• A deliberately broken test in a scratch commit (not merged) turns CI red.
• release still needs shell.

12. Unit and integration tests#

The existing Rust tests are the tests. Any fixed test gets a one-line note in the PR on why it failed.

13. Manual verification#

Read the job log and confirm the expected number of tests ran in watchdog, policy_tests, the sign-in module and the integrity module.

14. Documentation#

CONTRIBUTING.md: "Run cargo test in app/src-tauri on Windows."

15. Rollback#

Revert the workflow change.

16. Definition of Done#

Merged with CI green, test count in the PR description, inventory rows FEAT-SHL-03, FEAT-SHL-09, FEAT-FAB-05 and FEAT-REL-01 updated with test evidence after review.