[TrapsterDK]

Closes #2443.

Removes production API in cli/adopt that only tests used, and cuts the dx_adopt facade down to the names other crates import. Users see no change in behavior.

Deleted

• policy.rs (devcontainer_is_admissible, diagnostics_command_allowed)
• scaffold: render_consumer_own_toolchain_setup, render_consumer_renamed_setup, editor_disposition, editor_language_supported
• version: PREVIOUS_VERSION, rollback_re_pins_previous
• migrate: migrate_is_major_bump
• defaults: is_truthy, shares_file_with_other_tables
• status: render_status_json, StatusPayload, Serialize on StatusCheck. Status JSON still comes from cli/cli events.
• watch: watch_for_change
• the tests for each of these, and the *_reexports_match_local_definitions tests

Moved

• ConsumerSetup and parse_consumer_setup now live in #[cfg(test)] pub(crate) mod version::consumer_setup.

Facade

• lib.rs pub use now lists exactly the 54 names that cli/cli, cli/update and cli/advisory_prep import. Code inside the crate uses crate::<module>:: paths.

Other changes

• ConfigFile.dependency_set is renamed to _dependency_set with #[serde(rename = "dependency_set")]. The field has no reader any more, and this avoids a dead_code warning without adding #[allow]. It still parses [[dependency_set]] and still rejects values that are not arrays. A new test pins that: new_files_reject_a_non_array_dependency_set.
• migrate_syntax_pins_semver_prerelease_and_errors now checks migrate_is_upgrade for prerelease, build-metadata and non-semver cases.
• The watch idle-timeout test now uses WatchSession directly (session_reports_created_files_and_times_out_when_idle).
• BUILD: removed src/policy.rs and //cli/fingerprint:dx_fingerprint. Gazelle kept insta. Cargo.toml and the lockfile are unchanged.
• ghcr.yml: only the echo text changes, dropping its mention of devcontainer_is_admissible.

Verification

• tools/dx fix --affected: lint and typecheck report 0 warnings over the affected set, which includes //:dx and //cli/cli:dx_cli. Format flagged cli/cli/src/exec/{test_support,umbrella}.rs. Those files were already unformatted on main and this PR does not touch them.
• bazel test //cli/adopt/... //cli/update/... //cli/advisory_prep/... //quality:clippy_policy_test //tools/ci:release_assets_test: 12 of 12 pass.

Follow-ups

• Drop insta from cli/adopt/Cargo.toml and repin.
• Optionally, point the remaining in-crate super:: facade references at module paths.

🤖 Generated with Claude Code

https://claude.ai/code/session_011u9TXHDZrfmzFQ2WT8QAKK

[github-actions]

Coverage summary — coverage linux_x86_64 — FAIL

Analyzed revision: b4e489a1af7e0d210e7cf62ad00e55f22725b6ce | Run: https://github.com/devhusdk/rules_dx/actions/runs/40465059020 | Cell: coverage linux_x86_64.

Gate exit: 1 (comment never changes this outcome).

Changed-line gate exit: not configured

LCOV: Bazel-owned combined report for this cell (see workflow run 40465059020).

Scope: per-cell exact counts only; no cross-cell union, no averaged percentages, no rounding up. Codecov stays opt-in only, never required.

Findings outside the diff stay in counts only; no invented review locations.

[github-actions]

Coverage summary — coverage macos_arm64 — FAIL

Analyzed revision: b4e489a1af7e0d210e7cf62ad00e55f22725b6ce | Run: https://github.com/devhusdk/rules_dx/actions/runs/40465059020 | Cell: coverage macos_arm64.

Gate exit: 1 (comment never changes this outcome).

Changed-line gate exit: not configured

LCOV: Bazel-owned combined report for this cell (see workflow run 40465059020).

Scope: per-cell exact counts only; no cross-cell union, no averaged percentages, no rounding up. Codecov stays opt-in only, never required.

Findings outside the diff stay in counts only; no invented review locations.