Wächter für den Kern schärfen

Clippy sperrt im Kern Hash-Tabellen, Uhr, Dateien, Threads und
Umgebung über aufgelöste Pfade, auch bei Aliasen und gruppierten
Importen. Der Textwächter kennt globalen veränderlichen Zustand und
Prozesse, prüft sich selbst, und ein neuer Test hält die Abhängigkeiten
des Kerns leer.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

core/clippy.toml

@@ -0,0 +1,24 @@
+# Paths the deterministic core must never use. Clippy resolves imports, so
+# aliases and grouped imports such as `use std::{fs, env}` are caught too.
+# The text search in core/tests/forbidden_apis.rs covers the rest.
+
+disallowed-types = [
+    { path = "std::collections::HashMap", reason = "iteration order differs between runs; use BTreeMap or Vec" },
+    { path = "std::collections::HashSet", reason = "iteration order differs between runs; use BTreeSet or Vec" },
+    { path = "std::hash::RandomState", reason = "seeded differently in every run" },
+    { path = "std::hash::DefaultHasher", reason = "seeded differently in every run" },
+    { path = "std::time::Instant", reason = "the core must not read the clock" },
+    { path = "std::time::SystemTime", reason = "the core must not read the clock" },
+]
+
+disallowed-methods = [
+    { path = "std::env::var", reason = "the core must not depend on the environment" },
+    { path = "std::env::args", reason = "the core must not depend on the environment" },
+    { path = "std::thread::spawn", reason = "the core must stay single-threaded" },
+    { path = "std::fs::read", reason = "the core must not touch files" },
+    { path = "std::fs::read_to_string", reason = "the core must not touch files" },
+    { path = "std::fs::write", reason = "the core must not touch files" },
+    { path = "std::fs::File::open", reason = "the core must not touch files" },
+    { path = "std::fs::File::create", reason = "the core must not touch files" },
+    { path = "std::process::exit", reason = "the core must not end the process" },
+]