chore(ci): adopt the default Rust and Python function-complexity ratchet

[zackees]

Context

Fleet rollout follow-up from zackees/ci.yml#229. Audited FastLED/cli main bb1d619c1d64194198f9c68ac852fc79e6a01d9e in two rounds: root/member manifests, Python config, lint entry point, and reusable lint workflow.

• Root Cargo.toml has no [workspace.lints.clippy] cognitive_complexity/too_many_lines settings; crates/fastled-cli/Cargo.toml has no inherited workspace lints.
• pyproject.toml configures Ruff line length but does not select C901 or RUF100.
• Existing ./lint runs Soldr Clippy workspace/all-targets with -D warnings and Ruff over src/tests/ci. Existing _lint.yml calls that entry point and preserves a 30-minute job deadline, published Dylint preparation and Linux system dependencies.
• No root bosn.toml/local-gate.toml/ci.toml appeared in the root inventory. This establishes a missing root configuration, not proof that no alternative local runner exists anywhere.

Proposal

Enable the default function-complexity ratchet on the existing Rust and Python lint runs. Measure actual offenders, add only individual measured expectations/noqa, and preserve all existing checks. Inventory existing local orchestration before making any claim of complete Bosn→Act2 PR parity.

Acceptance criteria

• Demonstrate RED→GREEN with ci-lint complexity against current manifests/config and meaningful regressions: newly excessive functions fail; expectations/noqa that stop firing fail too.
• Root declares cognitive_complexity and too_many_lines at warn or stricter; every relevant member inherits. Keep default ceilings 25/100, no blanket allow or raised threshold.
• Ruff selects C901 and RUF100 with maximum complexity 10. Existing offenders receive measured per-function exceptions only; preserve external-linter noqa handling and inventory Python lint coverage.
• Run the exact original lint commands and required PR plan. Measure cfg-gated Rust offenders for every shipped target using static cross lint; target inventory alone must not expand native PR selection or ci-full.
• Preserve existing Dylint libraries, tools, runtime checks, build/test/artifact coverage and release validation. Do not add workflow files as a shortcut.
• If local PR orchestration is implemented, use Bosn→pinned Act2, verify completed required jobs/steps and exact source identity, and obtain tool-generated attestations only after the complete required plan passes. A lint-only run is not whole PR parity.
• Report actual baseline debt and exact tested source/tool revisions; do not claim speedup from configuration or isolated command timing.

Decisions

• Track this in FastLED/cli because the verified configuration gaps belong to this repository.
• Reuse existing lint runs; no new dependencies or new workflows are required for the ratchet.
• Keep runtime parity and performance claims conditional on complete execution evidence.

Open questions

What existing local orchestration, if any, reproduces the repository's complete ordinary PR plan? What measured baseline remains on each shipped target?

[zackees]

Implementation and first compiler evidence are now available in the isolated sister checkout, branch feat/function-complexity-ratchet (prepared commits efd6fc1, 6b8fc34; measured Rust exceptions not yet frozen/reviewed).

• Configuration RED: ci-lint reports five missing settings. After root/member/independent-Dylint settings, the checker reports zero violations.
• All 40 tracked Python files are discovered by the new root-configured complexity pass. The existing src/tests/ci lint stages remain intact; 13 actual C901 offenders receive line-level exceptions. Twelve targeted tests pass, including excessive-function and stale-noqa regressions.
• Full-feature native x86 Clippy uses the actual Rust1.95.0 toolchain, --workspace --all-targets --locked and -D warnings in a read-only-source Bosn container. It measured 15 unique existing offenders (13 too_many_lines, two cognitive); after individual expectations the strict command passes. Rust probes also fail specifically for new excessive lines, new cognitive complexity and stale expectations. Original format checks pass.
• The independent Dylint crate passes strict all-targets Clippy on nightly-2026-05-28 after original published Dylint6.0.3 preparation; no additional baseline exception. No from-source driver or cargo install was used.
• Actual workflow inspection confirms five unconditional ordinary native PR lint gates, rather than the documentation's prior Linux-x86-only claim; the draft corrects documentation while preserving every original gate.

ARM static cross lint found a real target dependency gap before application lint: authenticated Soldr GNUARM sysroot lacks GLib>=2.70 pkg-config metadata. Tracked separately as soldr#3570. Target-architecture Ubuntu24 dependencies are being provisioned for compiler-only measurement; host-x86 libraries or dropping the viewer feature are not accepted substitutes.

Remaining: all shipped-target measurements, original ./lint (including Dylint), original five-workflow Bosn→pinnedAct2 parity with completed job/step/source proofs, same primary review, and normal PR integration. These focused checks are not a whole-PR attestation or a speedup claim. Full release validation stays independent of attestations.