ci: clippy the opt-in feature builds, and cover the CLI

[jayhesselberth]

Stacked on #174 (which is stacked on #173). Targets worktree-crf-perf-punchlist, so the diff here is one file.

The gap

The features job ran cargo check. The workflow sets RUSTFLAGS: -Dwarnings, but that only denies lints that are actually evaluated — and cargo check never evaluates a clippy lint. Meanwhile the clippy job builds default features, which don't include crf-gpu. So an opt-in feature could carry a clippy error indefinitely with every check green.

Demonstrated on main as it stands right now:

cargo check  -p escapepod-cli --features crf-gpu   ->  0 errors   (what CI ran)
cargo clippy -p escapepod-cli --features crf-gpu   ->  2 errors   (what it missed)

That's clippy::large_enum_variant on the CLI's Basecaller enum, which #174 fixes. It has been failing silently for as long as crf-gpu has existed.

The fix

Switch those steps from check to clippy — clippy implies check, so no coverage is lost — and add components: clippy to the toolchain step, which the job didn't request.

Then close the two holes the bug was sitting in:

• crf-decode and crf-gpu weren't exercised at all. They pull tract-onnx, ort and fqxv-align, which is precisely the dependency-bump exposure this job exists to catch (per its own comment, that's how the cudarc and tract-onnx Dependabot PRs slipped through).
• Only the library crates were covered. The CLI is a different crate from the one each feature flag names, and it's where the feature-gated command wiring lives, so -p escapepod-demux structurally cannot see it. escapepod-cli now gets cnn-gpu and crf-gpu alongside the existing models-download.

Timeout 25 → 35 for the four extra steps. Still needs no CUDA toolkit, no libonnxruntime and no GPU — cudarc and ort both load dynamically.

Verification

All nine combinations run green locally on this branch:

escapepod-signal --features gpu                 ok
escapepod-demux  --features gpu                 ok
escapepod-demux  --features cnn-detect          ok
escapepod-demux  --features cnn-gpu             ok
escapepod-cli    --features cnn-gpu             ok
escapepod-demux  --features crf-decode          ok
escapepod-demux  --features crf-gpu             ok
escapepod-cli    --features crf-gpu             ok
escapepod-cli    --features models-download     ok

And the new command is confirmed to fail on unfixed code (the main result above), so this is a guard that actually guards rather than one that happens to be green.

Note

I kept the existing style of one cargo clippy per feature rather than adding --all-targets. Linting tests/benches/examples under each opt-in feature would be additional real coverage — the crf_basecall_check example is feature-gated, for instance — but it roughly doubles the job's work, so it seemed worth deciding separately rather than folding in here.