Verify and fix that [workspace.lints] is unenforced under Buck2 #3

Context: Cargo.toml declares [workspace.lints.rust] and [workspace.lints.clippy] with serious rules (cast_possible_truncation = "deny", pointer safety, stack-overflow prevention). Each crate opts in via [lints] workspace = true. However, Buck2's rust_library / rust_binary does not read Cargo.toml — so these lints are almost certainly unenforced when running just check / just clippy.

Scope:

1. Verify the finding. Write a small test: introduce a deliberate cast_possible_truncation violation in a throwaway branch of one crate, run just clippy, and confirm it passes. Compare with cargo clippy which should fail.
2. Create build/lints.bzl exporting RUSTC_FLAGS_LINTS and CLIPPY_FLAGS_LINTS as lists mirroring the Cargo.toml block.
3. Wire into build/rust.bzl so rust_library / rust_binary apply them via rustc_flags. Make overridable per-target for the burn-down period.
4. Delete [workspace.lints] from Cargo.toml (or leave a stub comment pointing at build/lints.bzl). Single source of truth.
5. Run just clippy and fix or triage the fallout. File follow-up issues per crate for the burn-down.

Acceptance: just clippy fails on a deliberately-introduced lint violation.