Make the CI checks say what they mean, and format the workspace

The Android job's "Verify minimum API level" step has never verified the
minimum API level. It took the first `*.so` anywhere under the target
directory, which is a host proc-macro from debug/deps — an x86-64 object
built by the runner's gcc, whose .comment section cannot mention Android
and so can never contradict the expected value. It now reads the artifact
under the target triple, compares against MIN_API parsed from the
Dockerfile rather than a second copy of the number, and fails on a
mismatch. Both sides are checked non-empty first: two failed parses would
otherwise compare equal and pass, which is the same silent success in a
new costume.

The Android image installs one SDK package per layer and keeps the
output. sdkmanager is a JVM program that aborts when it cannot get memory,
and the single `> /dev/null` step reported that as a bare "exit code 134"
while a retry re-downloaded everything that had already succeeded.

tools/ci-local.sh runs all four jobs — desktop, android, layering,
traceability — against the host toolchain, which is pinned to the same
1.92.0 CI installs. Its matrix check compares regeneration against the
working tree rather than against HEAD: CI starts from a clean checkout, so
git's answer is the right one there and reports every local run stale here.

The rest is rustfmt across the workspace, and the clippy findings that
surfaced once it did: manual_contains in dr-thumbs and collections_ui, a
map iterated as pairs for its keys, an index loop over a slice, and two
runtime assertions on a constant now made at compile time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/build-and-test.yml

@@ -93,16 +93,38 @@ jobs:
       # The linker targets MIN_API, not the compile SDK. cargo-ndk otherwise
       # defaults to API 21, far below the Vulkan floor this app needs — and the
       # mismatch is invisible until a device refuses to install.
+      #
+      # Look under the target triple, and fail on a mismatch. Searching the
+      # whole target dir for the first `*.so` found the host proc-macro
+      # libraries in target-android/debug/deps instead — x86-64 objects built
+      # by the runner's gcc, whose .comment section says nothing about Android
+      # and can never contradict the expected API. The step passed regardless
+      # of what the linker actually did, which is the one thing it exists to
+      # rule out.
       - name: Verify minimum API level
         env:
           CARGO_TARGET_DIR: target-android
         run: |
           set -e
           cargo ndk -t arm64-v8a build -p dr-gpu --release
-          SO=$(find target-android -name 'libdr_gpu*' -o -name '*.so' | head -1)
-          if [ -n "$SO" ]; then
-            echo "checking $SO"
-            readelf -p .comment "$SO" 2>/dev/null | head -5 || true
+          MIN_API=$(sed -n 's/^ARG MIN_API=\([0-9]*\).*/\1/p' docker/android/Dockerfile)
+          # Empty on both sides would compare equal and pass, so neither side
+          # is allowed to be the result of a failed parse.
+          if [ -z "$MIN_API" ]; then
+            echo "no ARG MIN_API= in docker/android/Dockerfile"
+            exit 1
+          fi
+          SO=$(find target-android/aarch64-linux-android/release -maxdepth 1 -name '*.so' | head -1)
+          if [ -z "$SO" ]; then
+            echo "no aarch64 .so was produced"
+            exit 1
+          fi
+          echo "checking $SO"
+          file "$SO"
+          API=$(file "$SO" | sed -n 's/.*for Android \([0-9]*\).*/\1/p')
+          if [ -z "$API" ] || [ "$API" != "$MIN_API" ]; then
+            echo "FAIL: linked for Android '${API:-unknown}', expected $MIN_API"
+            exit 1
           fi
 
   layering: