gates: clippy clean again, and the mail repro that never was for commit

`scripts/check.sh` has been failing before it ran a single test, on 62 clippy
findings in code none of the recent rounds touched — 32 in `benilla-world`, 30 in
`benilla-app` — so the in-loop gate could not tell anyone anything. Every one is a
newer clippy noticing older code (`as_chunks` and `is_multiple_of` are both lints
younger than the lines they fire on), and they are fixed, not silenced, except
where the silence is the point:

- **Argued allows, the house idiom.** `clippy::type_complexity` on ten Bevy system
  signatures and two inline caster queries, each with the one-line reason beside
  it, as the other 67 in this workspace have. `clippy::approx_constant` on
  `liquid/waves.rs`'s `TWO_PI`, whose own doc already says why it is spelled
  `6.2831853`: it mirrors a shader line, and `f32::consts::TAU` would stop reading
  against the file it copies.
- **Two runtime assertions became compile-time ones** (`EXT_SEL_EMPTY is index 255`,
  the endless-stream frame count): a claim about constants should fail the build
  that breaks it, not a test run after it.
- **Three real, if harmless, redundancies gone**: `len > MAX_TILT_TAN && len > 0.0`
  (the constant is `tan(4°)`, so the second test never spoke), `u32::from(..) + 1 |
  flags` now parenthesised where `+` binds tighter than `|`, and `palette.get(0)`.
- The rest is mechanical: `chunks_exact(3)` → `as_chunks::<3>()`, `map_or(true, ..)`
  → `is_none_or`, two `Default::default()`-then-assign test fixtures, a doc line
  that began `1.` and so turned its own paragraph into a list item, and
  `local_utc_offset_secs` moved above the test module it had drifted below.

`tests/repro_mail.rs` is deleted. Its first line says "TEMPORARY repro harness —
not for commit"; it reads a loose mirror of FrameXML out of `/tmp/opencode/
vanilla-ui`, which no longer exists, so it has been failing on a missing directory
rather than telling anyone about mail.

What is left of the gate's red is one test: `world_api_wall` counts 174 crossings
of the `benilla-world` boundary against a ceiling of 107 — 90 of them already
filed with a close plan, 84 unsorted. That is not cleanup; the wall's own message
says the remedies are to close the crossing or to publish it as engine API with the
record that says so, and 84 of those is a design pass on what the engine's public
surface is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgstFWtn1RxEJ5kVrpgYwn

crates/benilla-app/src/ui_script/flash_trace.rs

@@ -120,7 +120,7 @@ pub(crate) fn trace_visibility_churn(
     // Worst first: the driver is usually the top one, and its children follow it.
     // Worst first. The tie-break is the resolved name, so the line is stable run to run; it
     // resolves only after the truncation, which is the whole point of carrying handles.
-    loud.sort_by(|a, b| b.1.cmp(&a.1));
+    loud.sort_by_key(|row| std::cmp::Reverse(row.1));
     loud.truncate(12);
     let mut named: Vec<(String, u32)> = loud
         .into_iter()

crates/benilla-app/src/ui_script/lifecycle.rs

@@ -856,6 +856,30 @@ pub(crate) fn shutdown_on_exit(
 /// player's own create (`0x5deb60 call 0x4908c0`). This fires `PLAYER_LOGIN` at the end of the
 /// load on both, the `/reload` shape; `PLAYER_ENTERING_WORLD` fires from [`crate::ui_unit`] once
 /// the self descriptor lands.
+/// The player's UTC offset in seconds, for `date()` and `C_DateAndTime.GetServerTimeLocal`.
+///
+/// `std` has no local-time support, so this is `localtime_r` on the current instant: the offset
+/// *as it stands now*, DST included, rather than the zone's standard offset. Read once at VM setup
+/// — a session that crosses a DST boundary keeps the offset it booted with, which is one hour
+/// wrong for the rest of that session and is the same thing every client that caches it does.
+///
+/// 0 on failure, which is UTC — the behaviour this tree had everywhere before, so a broken or
+/// missing zone database leaves the clock exactly where it used to be rather than off by a
+/// garbage amount.
+fn local_utc_offset_secs() -> i32 {
+    // SAFETY: `localtime_r` writes a caller-owned `tm` and takes a pointer to a live `time_t`;
+    // both live for the call, and the `_r` form keeps no global state.
+    unsafe {
+        let now: libc::time_t = libc::time(std::ptr::null_mut());
+        let mut tm: libc::tm = std::mem::zeroed();
+        if libc::localtime_r(&now, &mut tm).is_null() {
+            return 0;
+        }
+        // `tm_gmtoff` is seconds EAST of UTC, which is the sign `date()` wants to add.
+        i32::try_from(tm.tm_gmtoff).unwrap_or(0)
+    }
+}
+
 #[cfg(test)]
 pub(crate) fn finish_ui_load(script: &mut UiScript) {
     finish_ui_load_with(script, |_| {}, |_| {});
@@ -1099,27 +1123,3 @@ mod tests {
         );
     }
 }
-
-/// The player's UTC offset in seconds, for `date()` and `C_DateAndTime.GetServerTimeLocal`.
-///
-/// `std` has no local-time support, so this is `localtime_r` on the current instant: the offset
-/// *as it stands now*, DST included, rather than the zone's standard offset. Read once at VM setup
-/// — a session that crosses a DST boundary keeps the offset it booted with, which is one hour
-/// wrong for the rest of that session and is the same thing every client that caches it does.
-///
-/// 0 on failure, which is UTC — the behaviour this tree had everywhere before, so a broken or
-/// missing zone database leaves the clock exactly where it used to be rather than off by a
-/// garbage amount.
-fn local_utc_offset_secs() -> i32 {
-    // SAFETY: `localtime_r` writes a caller-owned `tm` and takes a pointer to a live `time_t`;
-    // both live for the call, and the `_r` form keeps no global state.
-    unsafe {
-        let now: libc::time_t = libc::time(std::ptr::null_mut());
-        let mut tm: libc::tm = std::mem::zeroed();
-        if libc::localtime_r(&now, &mut tm).is_null() {
-            return 0;
-        }
-        // `tm_gmtoff` is seconds EAST of UTC, which is the sign `date()` wants to add.
-        i32::try_from(tm.tm_gmtoff).unwrap_or(0)
-    }
-}