fix(ci): unbreak Hawk and match its documented advisory intent

[ScriptedAlchemy]

Two separate problems, one job

1. Hawk never got to lint. It died at compile:

error[E0425]: cannot find type `Value` in this scope
   --> tests/mcp_suite/mcp_dashboard_tool_test.rs:120:18

mcp_dashboard_tool_test.rs uses serde_json::Value inside a #[cfg(feature = "test-transport")] test but only imports json. Hawk builds that target with --all-features; the ordinary gates do not — same rot class as the earlier test-transport breakage, where a target nothing routinely builds is free to stop compiling. Fixed with a matching gated import, following the file's existing pattern.

2. With that fixed, Hawk runs — and reports 9,032 findings. So the job would have gone on failing regardless of the import.

hawk::unnecessary_public:               7069
hawk::unnecessary_restricted_visibility: 1280
hawk::dead_public:                       683

The job's own header already says what should happen here:

Additive visibility lint. Not a required check yet — introduce Hawk, then promote once the workspace is clean under -D warnings.

But the step ran -D warnings with no continue-on-error, so it hard-failed and surfaced as a red check. The intent and the implementation disagreed; this makes them agree.

-D warnings is deliberately kept so the report stays honest and the backlog stays visible. Only the gate is dropped, with a comment saying to remove that line once the backlog is burned down.

What this does not do

It does not fix 9,032 visibility findings, and it is not an attempt to hide them. If you would rather Hawk stay gating, the alternative is a baseline file or a per-crate ratchet — say so and I will do that instead.

Verification

cargo +1.97.1 hawk check --target-dir target/hawk -D warnings now completes and produces its report instead of failing to build. cargo check --tests --features test-transport --locked is clean.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7afbd13

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c6fe3eb2d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep Hawk execution failures visible

When the Hawk invocation fails for a reason other than the known visibility findings—for example, an all-feature target stops compiling or Hawk crashes—continue-on-error: true also turns that failure into a successful job, so CI can go green without producing the advisory report at all. The compile failure fixed by this same commit is exactly such a scenario. Make findings non-blocking without accepting every failure from the command, such as by avoiding promotion of warnings to an error exit or distinguishing Hawk's findings exit code.

AGENTS.md reference: AGENTS.md:L126-L128

Useful? React with 👍 / 👎.

[ScriptedAlchemy]

Updated to base head. The serde_json::Value import fix landed independently in the base, so this PR now reduces to a single change: making the Hawk step non-gating.

That is the whole remaining diff — 7 added lines in .github/workflows/ci.yml.

The reasoning is unchanged and still holds: with the build fixed, Hawk reports 9,032 visibility findings (7,069 unnecessary_public, 1,280 unnecessary_restricted_visibility, 683 dead_public), and the job header already says it is "Not a required check yet — introduce Hawk, then promote once the workspace is clean under -D warnings". The step contradicted that by hard-failing. -D warnings is kept so the report stays honest; only the gate is dropped, with a comment saying to remove that line once the backlog is burned down.

Clippy passes on this branch, which also confirms #719's fixes hold on the current base.