…exceptions (#179)

First PR in the post-file-policy 0.4.0 rollout. Adds the Clippy ledger
infrastructure called for by docs/CLIPPY_POLICY.md. Ledger-only —
no lint activation; that's PR 7 (#191).

## Three TOML ledgers under policy/

- **clippy-lints.toml** — authoritative record of active + planned
  Clippy lints. Mirrors the tables in docs/CLIPPY_POLICY.md:
    4 [[active]] entries: rust::unsafe_code, clippy::dbg_macro,
                          clippy::todo, clippy::unimplemented
    10 [[planned]] entries: 4 at min_msrv 1.94, 6 at min_msrv 1.95
                            (the full PR 7 lint set)
- **clippy-debt.toml** — empty. Workspace is currently Clippy-clean;
  real entries arrive when PR 7 activates new lints with measured
  fallout.
- **clippy-exceptions.toml** — empty. Real entries are added
  intentionally when a specific suppression is judged durable.

## Two xtask checkers

### `cargo xtask check-lint-policy`

Validates that MSRV agrees across:
  - Cargo.toml `[workspace.package] rust-version`
  - clippy.toml `msrv`
  - policy/clippy-lints.toml `msrv`

Plus: every lint in `[workspace.lints.clippy]` (currently 0) must have
a ledger entry. Reverse direction (ledger entries not in
[workspace.lints.clippy]) is intentionally not enforced — [[active]]
entries are aspirational until PR 7 activates them.

Live output:
  msrv aligned across all three: 1.95
  check-lint-policy: workspace.lints.clippy=0 active_in_ledger=4 planned_in_ledger=10

### `cargo xtask check-clippy-exceptions`

For each entry in clippy-exceptions.toml:
  - validates required fields (lint, path, owner, reason, expires)
  - fails on expired entries

Plus a shallow regex scan for bare `#[allow(clippy::...)]` attributes
in tracked Rust source. Each occurrence is reported as an
**informational note** (the policy doc requires
`#[expect(clippy::lint, reason = "...")]` form), but the scan does
NOT fail the check in this PR. PR 5 is ledger-only; converting
bare-allows is a future PR.

Live output on current main:
  check-clippy-exceptions: entries=0 expired=0 schema_errors=0 bare_allow_informational=10

The 10 surfaced bare-allow sites in shipper-core/src/engine/ and
shipper-core/src/runtime/ are recorded for future conversion in a
follow-up PR.

## Decisions

- **Debt expiry semantics: fail for exceptions, warn for debt.**
  This PR only adds the exceptions checker (which fails on expired).
  Debt expiry handling lands when PR 7 begins populating the debt
  ledger.
- **Bare-allow scan: informational only.** Honest to the ledger-only
  scope. Future PR converts existing bare-allows to expect+reason and
  flips the scan to blocking.
- **`[[planned]]` reverse-direction not enforced.** Lets PR 7
  activate lints from the ledger one at a time without first having
  to remove their `[[planned]]` entries here.

## Acceptance

- cargo check --workspace --locked passes.
- cargo clippy -p xtask --all-targets --locked -- -D warnings clean.
- cargo fmt --all -- --check clean.
- cargo xtask check-lint-policy exits 0.
- cargo xtask check-clippy-exceptions exits 0.
- cargo xtask policy-report still produces unified artifact.
- All three policy/clippy-*.toml files parse as valid TOML.

## Out of scope

- PR 7 (#191): activate Clippy 1.94/1.95 ratchet lints (the 10
  [[planned]] entries here).
- Convert existing bare `#[allow(clippy::...)]` to
  `#[expect(..., reason = "...")]`.
- Wire check-lint-policy / check-clippy-exceptions into CI as
  blocking checks. Currently they're available via xtask only.

Closes #179.