Finish #974 tail: dylint violation cleanup (#964) + cold-pipeline overlap (#953) #990

Handoff for the last two open sub-issues of #974 (ESP32 cold/warm build perf + CI hygiene). Four of the six sub-issues are resolved+merged (#970, #966 incl. #986, #954, #960). This issue captures the exact remaining state of the last two so the work can resume cleanly.

#964 — dylint job green + lints enforcing

Done (pushed): PR #989, branch fix/964-dylint-link, commit 4984b38a. Root cause found + fixed: only ban_std_pathbuf had .cargo/config.toml with rustflags = ["-C", "linker=dylint-link"]; the other 24 dylint crates lacked it, so cargo-dylint 5.0.0 emitted bare <name>.so instead of <name>@<toolchain>.so, couldn't find the libs, and the alias-loop workaround never converged → no custom lints enforced. Added the config to all 24. Verified in CI: all 25 lint libraries now build with the @toolchain suffix and actually run (the alias loop no longer even fires).

Remaining: now that the lints run for the first time, they catch real accumulated violations, so the Dylint check on #989 is still FAILURE. Must fix genuine violations / allowlist intentional ones until dylint is zero-error workspace-wide. Known so far (dylint stops at the first crate with errors — there may be more beyond fbuild-packages):

• ban_manual_slash_normalize: hand-rolled .replace('\', "/") — fix to fbuild_core::path::NormalizedPath::display_slash(). Notably in object_hash_key in crates/fbuild-packages/src/library/library_compiler.rs and crates/fbuild-build/src/compiler.rs (both landed via fix(build): ESP32 sketch+core compiles hit zccache cross-project (#966) #985's cross-project cache-key work).
• ban_raw_path_prefix_compare: raw Path::strip_prefix compares that can feed a cache key — normalize via fbuild_core::path::normalize_for_key/NormalizedPath, or allowlist in dylints/ban_raw_path_prefix_compare/src/allowlist.txt with a one-line reason when not cache-key-feeding.
• ban_std_pathbuf: several std::path::PathBuf uses (incl. new crates/fbuild-packages/src/library/esptool.rs) — allowlist per-file with reasons, or switch to NormalizedPath where genuinely a normalized path.

Local dylint repro recipe (fast iteration beats ~15-min CI rounds), inside the fbuild-profile-linux container:

• Container is missing libssl-dev → apt-get update && apt-get install -y libssl-dev pkg-config.
• soldr toolchain lives at /root/.soldr: set RUSTUP_HOME=/root/.soldr/rustup CARGO_HOME=/root/.soldr/cargo and PATH=/root/.soldr/bin:/root/.soldr/cargo/bin:$PATH (confirm the actual rustup home under /root/.soldr first).
• rustup toolchain install nightly-2026-03-26 --component rustc-dev,llvm-tools-preview --profile minimal
• cargo install cargo-dylint dylint-link --version 5.0.0 --locked
• uv run python ci/build_dylint_driver.py
• cargo dylint --all -- --workspace --all-targets ← should reach zero errors when done.

Then push to fix/964-dylint-link; the Dylint check on #989 must go green. Do not weaken/disable any lint or blanket-allowlist directories.

#953 — cold-pipeline overlap

State: worktree branch fix/953-cold-overlap (not pushed). clippy + lib tests were green; was mid cold-build A/B profiling and not yet proven to reduce the ~185–237 s pioarduino-resolve phase. #967 already overlapped toolchain∥framework downloads via tokio::join!; the remaining candidates are: fold the platform download into that join, overlap extract with the next download, overlap lib_deps library download with resolve, and start fw-libs compile before resolve fully completes.

Remaining: finish the cold-build A/B (cold = fresh ~/.fbuild + ~/.platformio, run twice per side for network variance; read the pioarduino-resolve / total phase timings from the daemon.log config-parse perf line). Ship only if there's a measurable, real reduction with the build still exit 0 and no cache-dir races; otherwise document the numbers and close as diminishing-return. Validation container invocation and details are in the original #953 body.

Close-out

When #964's Dylint check is green (admin-merge PR #989) and #953 is either merged or closed with numbers, close the parent #974.