Graduate the shell out of spikes/ into apps/lumbridge

The product was spikes/gpui-shell: a cargo workspace of its own, named in the
root manifest's exclude list. It inherited neither unsafe_code = "forbid" nor
clippy pedantic, and ./scripts/ci.sh never compiled it. Every test written into
it silently never ran, and apps/lumbridge was an eleven-line stub printing a
version string.

Four separate research passes over the sidebar, settings, devices, and theme
work independently discovered they were about to write substantial new code into
that directory. Graduating first means writing it once.

- apps/lumbridge is the product; spikes/ui-shell-model becomes
  crates/lumbridge-ui-fixture and joins the workspace.
- scripts/ci.sh takes --headless and --ui. The headless pass excludes the two UI
  crates by name, so a contributor changing lumbridge-core does not wait on a
  window toolkit, and a runner that cannot carry GPUI still gates everything
  else. A new crate is headless by default rather than silently joining the slow
  job.
- scripts/native-libs.sh replaces the ad-hoc symlink in the launcher, and says
  which apt package actually fixes the problem instead of working around it
  silently. The stale libxcb/libxkbcommon symlinks in the old spike target
  directory are gone; only libxkbcommon-x11.so was ever needed.
- deny.toml and cargo deny check licenses. spikes/README.md called GPUI's
  licence closure a hard gate and the scorecard scored it pending; graduation
  makes it the product's closure, so it is enforced rather than described. Two
  rejections were reviewed and allowed with the reasoning recorded in the file:
  webpki-roots under CDLA-Permissive-2.0 (Mozilla's CA store, data not code,
  reached through ureq) and libfuzzer-sys under NCSA (reached only under
  all-features via gpui's image decoder; no shipped build links it).

Clippy pedantic across both crates is clean at -D warnings. render was 353
lines; render_sidebar, render_tabs, and render_root come out of it, which the
sidebar rework needed anyway. The remaining over-length functions are single
declarative element trees and carry per-function allows with reasons, not a
blanket suppression.

Decision 0017 records the two calls this forces: published gpui 0.2.2 behind an
accessibility adapter rather than an unpinned Zed revision and an MSRV bump, and
Floem frozen rather than maintained in parity or deleted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/ci.sh

@@ -1,15 +1,70 @@
 #!/usr/bin/env bash
+# Lumbridge CI.
+#
+#   scripts/ci.sh              headless and UI
+#   scripts/ci.sh --headless   everything except the GPUI product
+#   scripts/ci.sh --ui         only the GPUI product and its fixture
+#
+# The split exists because the UI crates pull GPUI's dependency tree — several
+# hundred packages and a large target directory — while the headless crates
+# build in seconds. A contributor changing lumbridge-core should not wait for a
+# window toolkit, and a CI runner that cannot carry the UI job can still gate
+# everything else.
 set -euo pipefail
 
-cargo fmt --all --check
-cargo clippy --workspace --all-targets --all-features -- -D warnings
+run_headless=1
+run_ui=1
+case "${1:-}" in
+  --headless) run_ui=0 ;;
+  --ui) run_headless=0 ;;
+  "") ;;
+  *) echo "usage: $0 [--headless|--ui]" >&2; exit 2 ;;
+esac
 
-if command -v cargo-nextest >/dev/null 2>&1; then
-  cargo nextest run --workspace --all-features --profile "${NEXTEST_PROFILE:-default}"
+# The UI crates. Excluded from the headless pass by name so a new crate is
+# headless by default rather than silently joining the slow job.
+ui_packages=(lumbridge lumbridge-ui-fixture)
+
+cargo fmt --all --check
+
+# The product's licence closure. Graduating GPUI into the workspace made this
+# the product's problem rather than a spike's; deny.toml records which licences
+# were reviewed and why. Skipped rather than failed when the tool is absent, so
+# a contributor without it is not blocked.
+if command -v cargo-deny >/dev/null 2>&1; then
+  cargo deny check licenses
 else
-  echo "cargo-nextest not installed; using cargo test" >&2
-  cargo test --workspace --all-features
+  echo "cargo-deny not installed; skipping the licence gate (cargo install cargo-deny)" >&2
 fi
 
-# nextest deliberately does not run doctests on stable Rust.
-cargo test --workspace --all-features --doc
+test_runner() {
+  if command -v cargo-nextest >/dev/null 2>&1; then
+    cargo nextest run "$@" --all-features --profile "${NEXTEST_PROFILE:-default}"
+  else
+    echo "cargo-nextest not installed; using cargo test" >&2
+    cargo test "$@" --all-features
+  fi
+}
+
+if [ "$run_headless" = 1 ]; then
+  exclusions=()
+  for package in "${ui_packages[@]}"; do
+    exclusions+=(--exclude "$package")
+  done
+  cargo clippy --workspace "${exclusions[@]}" --all-targets --all-features -- -D warnings
+  test_runner --workspace "${exclusions[@]}"
+  # nextest deliberately does not run doctests on stable Rust.
+  cargo test --workspace "${exclusions[@]}" --all-features --doc
+fi
+
+if [ "$run_ui" = 1 ]; then
+  # shellcheck source=/dev/null
+  . "$(dirname "$0")/native-libs.sh"
+  selections=()
+  for package in "${ui_packages[@]}"; do
+    selections+=(-p "$package")
+  done
+  cargo clippy "${selections[@]}" --all-targets --all-features -- -D warnings
+  test_runner "${selections[@]}"
+  cargo test "${selections[@]}" --all-features --doc
+fi

scripts/native-libs.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Makes GPUI's X11 backend linkable on distributions that ship
+# libxkbcommon-x11.so.0 without the unversioned development symlink.
+#
+# The real fix is installing libxkbcommon-x11-dev. When that package is absent
+# this creates the one symlink the linker needs in a cache directory and exports
+# LIBRARY_PATH, so a UI build works without root. Source it, do not run it.
+#
+#   source scripts/native-libs.sh
+
+lumbridge_native_libs() {
+  local runtime=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so.0
+  local devlink=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so
+  if [ -e "$devlink" ]; then
+    return 0
+  fi
+  if [ ! -e "$runtime" ]; then
+    echo "libxkbcommon-x11 is not installed; a UI build will fail to link" >&2
+    echo "  install it with: sudo apt install libxkbcommon-x11-dev" >&2
+    return 0
+  fi
+  local cache="${XDG_CACHE_HOME:-$HOME/.cache}/lumbridge-native-libs"
+  mkdir -p "$cache"
+  ln -sfn "$runtime" "$cache/libxkbcommon-x11.so"
+  export LIBRARY_PATH="$cache${LIBRARY_PATH:+:$LIBRARY_PATH}"
+  echo "using $cache for libxkbcommon-x11.so (install libxkbcommon-x11-dev to avoid this)" >&2
+}
+
+lumbridge_native_libs

scripts/open-metal-lumbridge.sh

@@ -4,8 +4,8 @@ set -euo pipefail
 repo_path=${LUMBRIDGE_REPO:-/home/metal/Desktop/Lumbridge Code/lumbridge}
 window_title='Lumbridge · GPUI workspace'
 bacon_title='Lumbridge · Bacon'
-manifest_path="$repo_path/spikes/gpui-shell/Cargo.toml"
-binary_path="$repo_path/spikes/gpui-shell/target/debug/lumbridge-spike-gpui"
+manifest_path="$repo_path/Cargo.toml"
+binary_path="$repo_path/target/debug/lumbridge"
 
 if [[ ! -d "$repo_path/.git" ]]; then
   echo "Lumbridge repository not found at $repo_path" >&2
@@ -34,14 +34,9 @@ if [[ ! -x "$binary_path" ]]; then
     echo "required command not found: cargo" >&2
     exit 1
   fi
-  xkb_runtime=/usr/lib/x86_64-linux-gnu/libxkbcommon-x11.so.0
-  if [[ -e "$xkb_runtime" ]]; then
-    native_libs="$repo_path/spikes/gpui-shell/target/native-libs"
-    mkdir -p "$native_libs"
-    ln -sfn "$xkb_runtime" "$native_libs/libxkbcommon-x11.so"
-    export LIBRARY_PATH="$native_libs${LIBRARY_PATH:+:$LIBRARY_PATH}"
-  fi
-  cargo build --locked --manifest-path "$manifest_path"
+  # shellcheck source=/dev/null
+  source "$repo_path/scripts/native-libs.sh"
+  cargo build --locked --manifest-path "$manifest_path" -p lumbridge
 fi
 
 # GPUI's X11 client sets WM_NAME but not _NET_WM_NAME, so wmctrl's window list