feat(xtask,ci): add check features matrix gate with dynamic CI fan-out

Adds a feature-matrix CI gate per #1123 (CI: feature matrix including
`arbitrary`). The case enumeration lives in xtask so the matrix is
self-documenting and locally reproducible.

`cargo xtask check features` is the new subcommand. Three modes:

  cargo xtask check features
      Run every case sequentially. Mirrors what CI does in aggregate.

  cargo xtask check features --case <NAME>
      Run a single case. CI matrix workers use this; the case name
      doubles as the local repro command for any failure.

  cargo xtask check features --list [--format <FMT>]
      Enumerate cases. `--format github-matrix` emits a JSON include
      array for `strategy.matrix.include: ${{ fromJson(...) }}`.

Two new CI jobs in `.github/workflows/ci.yml`:

  feature-matrix-setup
      Preflight job. Runs `cargo xtask check features --list --format
      github-matrix` and emits the JSON via `$GITHUB_OUTPUT`.

  feature-matrix [${{ matrix.case }}]
      Fan-out job. Consumes the preflight output via fromJson and runs
      `cargo xtask check features --case '${{ matrix.case }}'` per case.

Both join the existing `success` job's `needs` list so branch protection
keeps a single required status check. Each worker writes a one-line
markdown entry to `$GITHUB_STEP_SUMMARY` so failures show in the run
summary view without expanding logs.

Initial case set (10):

  - per-crate curated invariants (ironrdp-core std/alloc, ironrdp-pdu
    std/arbitrary/arbitrary-alloc)
  - workspace powersets partitioned by layer: foundation, pdu, channels,
    connector-session, runtime

cargo-hack pinned at 0.6.44 in xtask/src/bin_version.rs, installed via
the existing `cargo xtask check install` flow.

ironrdp-tls / ironrdp-client / ironrdp-mstsgu intentionally outside the
initial case set. cargo-hack does not honor package.metadata.cargo-hack,
so the exactly-one-of TLS-backend constraint needs `--mutually-exclusive
-features`, `--at-least-one-of`, and `--exclude-no-default-features` on
the invocation. The powerset also surfaces a latent bug in
`extract_tls_server_public_key` that uses `x509_cert::*` unconditionally
instead of gating on `rustls | native-tls`. Both are tractable but out
of scope for this gate's initial landing; the regular Checks job
already exercises all three crates with their default features.

Closes #1123 items 1-3 of the remediation set posted in
issuecomment-4464512384. Items 4-5 (the `ironrdp-web` exclusion and the
cargo-hack version pin) are folded into the per-case `extra_args` and
`bin_version.rs` respectively. The TLS coverage gap is the remaining
item from the original five.

Signed-off-by: Greg Lamberson <greg@lamco.io>
Assisted-by: Claude Code (Anthropic, Opus)

Author: glamberson

.github/workflows/ci.yml

@@ -201,10 +201,61 @@ jobs:
       - name: Build .NET projects
         run: cd ./ffi/dotnet && dotnet build
 
+  feature-matrix-setup:
+    name: feature matrix setup
+    needs: [formatting]
+    runs-on: ubuntu-latest
+    outputs:
+      feature-matrix: ${{ steps.setup-matrix.outputs.feature-matrix }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2.7.3
+
+      - name: Setup matrix
+        id: setup-matrix
+        run: |
+          MATRIX="$(cargo xtask check features --list --format github-matrix)"
+          echo "feature-matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+
+  feature-matrix:
+    name: feature matrix [${{ matrix.case }}]
+    needs: [formatting, feature-matrix-setup]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.feature-matrix-setup.outputs.feature-matrix) }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install devel packages
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get -y install libasound2-dev
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2.7.3
+
+      - name: Binary cache
+        uses: actions/cache@v5
+        with:
+          path: ./.cargo/local_root/bin
+          key: ${{ runner.os }}-bin-${{ github.job }}-${{ hashFiles('xtask/src/bin_version.rs') }}
+
+      - name: Prepare
+        run: cargo xtask check install -v
+
+      - name: Run feature-matrix case
+        run: cargo xtask check features --case '${{ matrix.case }}' -v
+
   success:
     name: Success
     if: ${{ always() }}
-    needs: [formatting, typos, checks, fuzz, web, ffi]
+    needs: [formatting, typos, checks, fuzz, web, ffi, feature-matrix-setup, feature-matrix]
     runs-on: ubuntu-latest
 
     steps:

xtask/src/bin_version.rs

@@ -4,6 +4,7 @@
 use crate::bin_install::CargoPackage;
 
 pub const CARGO_FUZZ: CargoPackage = CargoPackage::new("cargo-fuzz", "0.12.0");
+pub const CARGO_HACK: CargoPackage = CargoPackage::new("cargo-hack", "0.6.44");
 pub const CARGO_LLVM_COV: CargoPackage = CargoPackage::new("cargo-llvm-cov", "0.6.16");
 pub const GRCOV: CargoPackage = CargoPackage::new("grcov", "0.8.20");
 pub const WASM_PACK: CargoPackage = CargoPackage::new("wasm-pack", "0.13.1");

xtask/src/check.rs

@@ -45,9 +45,10 @@ pub fn typos(sh: &Shell) -> anyhow::Result<()> {
 }
 
 pub fn install(sh: &Shell) -> anyhow::Result<()> {
-    let _s = Section::new("TYPOS-CLI-INSTALL");
+    let _s = Section::new("CHECK-INSTALL");
 
     cargo_install(sh, &TYPOS_CLI)?;
+    cargo_install(sh, &CARGO_HACK)?;
 
     Ok(())
 }

xtask/src/cli.rs

@@ -15,6 +15,11 @@ TASKS:
   check locks             Check for dirty or staged lock files not yet committed
   check tests [--no-run]  Compile tests and, unless specified otherwise, run them
   check typos             Check for typos in the codebase
+  check features          Run every feature-matrix case sequentially
+  check features --case <NAME>
+                          Run a single feature-matrix case
+  check features --list [--format <FMT>]
+                          List feature-matrix cases (fmt: human (default) | github-matrix)
   check install           Install all requirements for check tasks
   ci                      Run all checks required on CI
   clean                   Clean workspace
@@ -62,6 +67,11 @@ pub enum Action {
         no_run: bool,
     },
     CheckTypos,
+    CheckFeatures {
+        case: Option<String>,
+        list: bool,
+        format: Option<String>,
+    },
     CheckInstall,
     Ci,
     Clean,
@@ -116,6 +126,11 @@ pub fn parse_args() -> anyhow::Result<Args> {
                     no_run: args.contains("--no-run"),
                 },
                 Some("typos") => Action::CheckTypos,
+                Some("features") => Action::CheckFeatures {
+                    case: args.opt_value_from_str("--case")?,
+                    list: args.contains("--list"),
+                    format: args.opt_value_from_str("--format")?,
+                },
                 Some("install") => Action::CheckInstall,
                 Some(unknown) => anyhow::bail!("unknown check action: {unknown}"),
                 None => Action::ShowHelp,