Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 94-114: Add a cleanup step that removes cached receipt outputs
(e.g., rm -f target/xtask/economics/latest.*
target/xtask/audit-surface/latest.*) before running the receipt generation steps
and before the upload step so stale files can't be uploaded; insert a new step
named like "clean cached receipts" immediately before the "economics receipt"
and "audit-surface receipt" runs and also before the "Upload lane receipts"
step, and replicate the same cleanup in the other workflow block referenced (the
second pr/main block around the other occurrence) to ensure both PR and main
runs remove old latest.* files first.

In `@crates/materialize-buildrs-example/build.rs`:
- Around line 1-4: Add the crate-level attribute to prohibit unsafe code by
inserting the attribute directive at the top of the file before any items (i.e.,
above the existing use statements); specifically add the crate attribute
forbidding unsafe code so the crate-level directive applies to the whole file
containing the main function and the use declarations.

In `@crates/materialize-buildrs-example/src/lib.rs`:
- Around line 1-3: Add a crate-level forbid for unsafe code by inserting
#![forbid(unsafe_code)] at the top of this crate root (the file that contains
the include!(concat!(env!("OUT_DIR"), "/fixtures.rs")) and #[cfg(test)]), so the
generated source pulled in by include! is covered by the workspace safety
guarantee; place the attribute before any items or includes in this file.

In `@crates/materialize-shape-buildrs-example/build.rs`:
- Around line 1-5: Add the crate-level unsafe-code guard by inserting the
attribute #![forbid(unsafe_code)] at the top of the build script (before any use
statements) so the build.rs file enforces the workspace ban on unsafe code;
update the file that contains the main function in build.rs to include this
attribute above the existing items.

In `@crates/materialize-shape-buildrs-example/src/lib.rs`:
- Line 1: Add the crate-level attribute to forbid unsafe code by placing
#![forbid(unsafe_code)] at the top of this crate root (above the existing
include!(concat!(env!("OUT_DIR"), "/fixtures.rs")) line) so the crate-level
policy is enforced; ensure the attribute appears before any other items in
lib.rs to apply globally.

In `@crates/uselesskey-cli/src/lib.rs`:
- Around line 496-512: The SshPublicKeyShape branch
(MaterializeKind::SshPublicKeyShape) returns 32 random bytes encoded as an
"ssh-ed25519" blob using Seed::from_text, BASE64_STD.encode, and
normalize_ssh_comment, but that output is not a valid Ed25519 public key
structure; add a concise doc comment near the SshPublicKeyShape branch or the
function that emits this blob clarifying that this is a shape-only/test fixture
and not a cryptographically valid Ed25519 public key, and mention it
intentionally produces 32 random bytes rather than the real SSH key format so
future readers won't assume validity.

In `@docs/how-to/choose-features.md`:
- Around line 33-86: The fenced TOML code blocks under the "Dependency
snippets:" section (each ```toml ... ```) are missing surrounding blank lines
which triggers MD031; fix by adding a blank line before the opening ```toml and
a blank line after the closing ``` for every snippet (e.g., the blocks under the
"- **Quick start (RSA)**", "- **Token-only**", "- **JWT/JWK**", "- **X.509 +
rustls**", "- **jsonwebtoken adapter**", and "- **JOSE/OpenID adapter**", "-
**pgp-native adapter**" headings) so each fenced block is separated from
adjacent text and list items.

In `@docs/metadata/workspace-docs.json`:
- Line 1121: You added "entropy" to public_features but didn't add its
corresponding metadata entries; update the synced metadata by adding a matching
facade_feature_matrix row for "entropy" (so facade_feature_matrix includes the
new public lane entry) and add entropy-focused snippet/example metadata and
README/choose-features content references so the generated README and
choose-features docs include usage examples and description for the entropy
feature. Ensure identifiers match "entropy" and the existing schema used for
other features so the sync process picks up the new lane.

In `@README.md`:
- Around line 121-125: The README snippet assumes the binary is run from this
workspace (uses cargo run -p uselesskey-cli) and points at an internal manifest
path, which breaks for downstream users; update the example to instruct users to
either run the installed binary (uselesskey-cli) or run cargo with an explicit
manifest path, and change the manifest path to a generic/local file (e.g.,
./uselesskey-fixtures.toml) so the materialize and verify commands (materialize,
verify) are copy-pasteable outside this repo; mention installing the CLI (cargo
install or equivalent) or using cargo run with --manifest-path to make the
example portable.

In `@xtask/src/audit_surface.rs`:
- Around line 125-152: The matched_markers function currently embeds hardcoded
version-prefix checks (e.g., "rsa v0.9.", "rsa v0.10.", "jsonwebtoken v", etc.),
which makes updates error-prone; refactor by extracting these string literals
into named constants or a small static map/array (e.g., MARKER_PATTERNS or
RSA_LEGACY_PREFIX, RSA_MODERN_PREFIX, JSONWEBTOKEN_PREFIX, X509_STACK_PREFIX)
and update matched_markers to iterate over those patterns to insert the
corresponding marker strings, keeping the matching logic (trimmed.starts_with)
but centralizing patterns for easier maintenance and future updates.

In `@xtask/src/economics.rs`:
- Around line 196-222: The duration conversion in run_cargo currently does let
duration_ms = start.elapsed().as_millis() as u64 which can overflow when casting
u128 to u64; change this to a defensive conversion (e.g., use
try_into().unwrap_or(u64::MAX) or a saturating cast) when converting
start.elapsed().as_millis() to u64 so duration_ms is set safely; update the
assignment to duration_ms in the run_cargo function (referencing
Instant::elapsed, duration_ms, and the CommandRun return) to use the safe
conversion.

---

Outside diff comments:
In `@crates/uselesskey/README.md`:
- Around line 49-101: Each fenced code block in the dependency snippets (e.g.,
the blocks after headings like "Quick start (RSA)", "Token-only", "JWT/JWK",
"X.509 + rustls", "jsonwebtoken adapter", "JOSE/OpenID adapter", "pgp-native
adapter") must be surrounded by blank lines to satisfy MD031; edit README.md so
there is an empty line immediately before each opening triple-backtick and an
empty line immediately after each closing triple-backtick for every snippet in
the dependency-snippets section.
- Around line 193-200: Update the `full` feature description in the README table
to reflect that `entropy` is now included; replace the current "Everything
(`all-keys` + `token` + `x509` + `jwk`)" text for the `full` row with
"Everything (`all-keys` + `token` + `x509` + `jwk` + `entropy`)" so the `full`
feature accurately lists `entropy` alongside `all-keys`, `token`, `x509`, and
`jwk`.