Stop compiling the GPL crate GPUI drags in behind the framework

Lumbridge is Apache-2.0, and decision 0023 quietly made it link
GPL-3.0-or-later. `crates/gpui/Cargo.toml` at the pinned revision carries
`ztracing.workspace = true` -- unconditional, not optional, not behind a
feature -- and `ztracing` is GPL-3.0-or-later, as are the `zlog` and
`ztracing_macro` it pulls. `sum_tree` asks for it too. The path is the ordinary
Linux build, not an `--all-features` artefact and not a dev-dependency:

    lumbridge -> gpui_platform -> gpui_linux -> gpui -> ztracing -> zlog
                                                                -> ztracing_macro

`cargo deny check licenses` failed on it, exit 4.

This is the second thing decision 0023 got wrong by reading the manifests of the
crates it added instead of resolving the graph; the first was believing there
were two Zed Git sources when there are five. Both were found by a gate that had
never been run.

There was no feature to turn off, so the choice was to relax the licence policy,
drop the framework, or stop compiling the crate. `ztracing` is now redirected by
a `[patch]` table at `crates/lumbridge-ztracing-shim`, a first-party
zero-dependency no-op under Apache-2.0. `zlog` and `ztracing_macro` were
reachable only through it and leave the lockfile with it.

The shim is small because the usage is: nine `#[instrument(skip_all)]` sites
across `gpui/src/svg_renderer.rs`, `sum_tree/src/sum_tree.rs` and
`sum_tree/src/cursor.rs`, and nothing else. Upstream's own crate compiles to
almost exactly this whenever the `ztracing` cfg is off, which is every build
that is not a Tracy profiling build, so no shipping behaviour is lost. It is a
proc-macro crate deliberately: such a crate can export nothing but proc macros,
so an upstream revision that starts using `ztracing::Span` or
`ztracing::info_span!` fails to compile and names the shim, rather than
resolving to something plausible.

`scripts/workspace-guard.sh` gained a third gate asserting, against Cargo.lock
rather than the manifest, that no `ztracing`, `zlog` or `ztracing_macro`
resolves to a Zed source and that the patch table is still present. `cargo deny`
already checks this, and the duplication is the point: `scripts/ci.sh`
downgrades a missing cargo-deny to a warning unless `LUMBRIDGE_CI_STRICT=1`, and
that is how the licence closure went ungated once already. A `[patch]` is an
unusually quiet thing to lose -- delete the table and everything still compiles,
still passes, and is GPL again.

Removing the three GPL rejections exposed a fourth that had been sitting beside
them and was never reported separately: `libbz2-rs-sys` under `bzip2-1.0.6`,
reached through async-compression <- http_client <- gpui. It is BSD-style and
permissive with no copyleft, and is allowed in `deny.toml` with that reasoning
written down. `cargo deny check licenses sources` is exit 0 for the first time.

The Git-source allowances in `deny.toml` are all still needed; the patched
crate's own source was `zed.git`, which `gpui` still requires.

Decision 0025 records the whole of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq

scripts/workspace-guard.sh

@@ -86,7 +86,55 @@ for pkg in gpui gpui_platform; do
   fi
 done
 
+# ---------------------------------------------------------------------------
+# 3. No GPL crate has come back into the graph.
+#
+# `gpui` depends on `ztracing` unconditionally, and `ztracing` -- with the
+# `zlog` and `ztracing_macro` it pulls -- is GPL-3.0-or-later. That is a
+# licence problem for an Apache-2.0 product, and it is in the ordinary Linux
+# build, not behind a feature. The root manifest's
+# `[patch."https://github.com/zed-industries/zed.git"]` table redirects
+# `ztracing` at crates/lumbridge-ztracing-shim, a first-party no-op, and the
+# other two leave the graph with it.
+#
+# `cargo deny check licenses` already catches this, so why assert it here as
+# well? Because deny is a gate a runner can skip. scripts/ci.sh downgrades a
+# missing cargo-deny to a warning unless LUMBRIDGE_CI_STRICT=1, and that exact
+# arrangement is how the licence closure went ungated once already -- reported
+# green on a runner that had never installed the tool. This check needs no
+# tool, runs in milliseconds, and is what makes deleting the patch table a
+# failure rather than a quiet relicensing of the product.
+#
+# Asserted against Cargo.lock for the same reason as the gate above: the
+# manifest states an intent, and a `[patch]` whose URL does not match the
+# source character for character applies to nothing while still looking
+# correct in a diff. The lockfile states what would actually be compiled.
+for pkg in ztracing zlog ztracing_macro; do
+  block="$(awk -v pkg="$pkg" '$0 == "name = \"" pkg "\""{found=1} found{print} found&&/^$/{exit}' Cargo.lock)"
+  [ -n "$block" ] || continue
+  actual_source="$(printf '%s' "$block" | sed -n 's/^source = "\(.*\)"$/\1/p')"
+  case "$actual_source" in
+    "")
+      # No source line: a path package, which is the patched shim. Correct.
+      ;;
+    *)
+      echo "workspace-guard: $pkg resolves to $actual_source, not the local shim." >&2
+      echo "                 That crate is GPL-3.0-or-later and Lumbridge is Apache-2.0." >&2
+      echo "                 The [patch] table in Cargo.toml is missing, misspelled, or" >&2
+      echo "                 no longer matches the source it is meant to replace." >&2
+      echo "                 See crates/lumbridge-ztracing-shim/src/lib.rs." >&2
+      status=1
+      ;;
+  esac
+done
+
+if ! grep -qF '[patch."https://github.com/zed-industries/zed.git"]' Cargo.toml; then
+  echo "workspace-guard: the Zed [patch] table is gone from Cargo.toml." >&2
+  echo "                 Without it gpui compiles GPL-3.0-or-later ztracing." >&2
+  status=1
+fi
+
 if [ "$status" = 0 ]; then
-  echo "workspace-guard: crate membership and the pinned UI dependency are as recorded."
+  echo "workspace-guard: crate membership, the pinned UI dependency, and the GPL patch are as recorded."
 fi
 exit "$status"