CI: run the prek hook suite instead of hand-rolled cargo commands

CI previously re-implemented a subset of the prek hooks by hand (`cargo
test` + a bare `cargo clippy`), so `cargo fmt --check` and the stricter
`cargo clippy -- -D warnings` were enforced only by the local pre-commit
hook — easily bypassed with --no-verify (as PR #193 was). Run the same
prek suite CI-side so .pre-commit-config.yaml is the single source of
truth for what gets checked, on both commit and push.

Also drop the hard-coded `dtolnay/rust-toolchain@1.93.0` pin (which had
drifted from rust-toolchain.toml's 1.96.0) in favor of
actions-rust-lang/setup-rust-toolchain, which reads the toolchain version
and components from rust-toolchain.toml — so CI's rustfmt/clippy match
what developers run, and there is no second place to keep in sync. All
three actions are tag-pinned, so Renovate can manage them (unlike the
branch-pinned dtolnay ref).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -14,13 +14,37 @@ concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 jobs:
-  test-and-clippy:
-    name: Unit testing and linting
+  prek:
+    name: Lint, format & test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@1.93.0
+
+      # Rust version AND components (rustfmt, clippy) come from rust-toolchain.toml,
+      # the single source of truth shared with local dev. Nothing is pinned here, so
+      # CI can never drift from the toolchain developers (and the prek hooks) use.
+      # rustflags is cleared so a plain `cargo build`/`cargo test` keeps its previous
+      # behavior; the clippy hook still enforces `-D warnings` on lints.
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          rustflags: ''
+
       - name: Install SQLite3
         run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
-      - run: cargo test --all-features
-      - run: cargo clippy
+
+      # `just` drives the prek recipes; `mise` provides the pinned prek (mise.toml).
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
+      - uses: jdx/mise-action@v2
+
+      # Run the exact hook suite developers run locally: file hygiene, `cargo fmt
+      # --all -- --check`, and `cargo clippy -- -D warnings`. The hook config in
+      # .pre-commit-config.yaml is the single source of truth for what gets checked.
+      # The slow test hook is split out into its own step below so the Actions UI
+      # surfaces its timing separately.
+      - name: Lint & format (prek hooks, excluding tests)
+        run: just prek-run-on-all --skip test-unit
+
+      - name: Unit tests
+        run: just test