ci-verify-generated-codelisted

# Verifying Generated Code in CI Lessons from c2proof (C→Rust via c2rust, GitHub Actions e2e). Each cost ≥1 CI run of blind debugging. ## 1. Codegen tools smuggle toolchain pins into their output (verified: c2rust 0.20.0) `c2rust transpile --emit-build-files` writes `rust-toolchain.toml` into the generated crate, pinning the nightly the tool was BUILT on (`nightly-2022-08-08`). Host-side `cargo clippy` then fails with `'cargo-clippy' is not installed for the toolchain 'nightly-...'` — and if you check for a file named `rust-toolchain` only, your auto-install never fires (rustup honors both filenames; docs don't mention either). **Fix:** detect BOTH `rust-toolchain` and `rust-toolchain.toml`, at crate root and one level down; parse channel (bare line OR `[toolchain] channel = "..."`), run `rustup toolchain install <ch> --profile minimal --component clippy` (idempotent via `rustup toolchain list`). Belt-and-braces fallback: on clippy failure, extract the channel from the error string itself — covers any pin mechanism you didn't anticipate. ```rust fn stderr_missing_toolchain(stderr: &str) -> Option<String> { stderr.lines().find_map(|l| { let i = l.find("not installed for the toolchain '")?; let rest = &l[i + "not installed for the toolchain '".len()..]; Some(rest[..rest.find('')?].to_string()) }) } ``` **Check:** unit test parsing both file formats; e2e log line naming the pin path found. ## 2. Never apply your own lint gate to generated o