feat(3.6.6): local/uncensored llama.cpp provider, clippy clean, CI (#40)

Version bump 3.6.5 -> 3.6.6.

Local & uncensored models
- New `llamacpp:` provider (llama-server, OpenAI-compatible, localhost:8080,
  no API key, CPU-only or GPU-offloaded). Override via LLAMACPP_BASE_URL;
  model name is the loaded gguf (pass-through). 15 -> 16 providers.
- README: local/uncensored highlight, provider table + key-less note, badges.

Quality
- clippy clean under `-D warnings`: clamp(), sort_by_key(Reverse), struct-literal
  init, too_many_arguments allows, scoped await_holding_lock on the REPL blocking
  fallback (guard intentionally held across run().await), plus clippy --fix set.

CI
- examples/github-actions/ci.yml: cargo build/test/clippy -D warnings for the
  neurosploit-rs workspace (template, kept out of .github/workflows).


Claude-Session: https://claude.ai/code/session_01QDses7zTSa9YF7pPRjphvh

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

examples/github-actions/README.md

@@ -9,6 +9,7 @@ variables → Actions), or swap the `MODEL`/key for a provider you use. The buil
 |----------|--------------|
 | `neurosploit-pr-gate.yml` | Reviews every pull request and **blocks the merge** on a confirmed critical (fails the check + sets a `neurosploit/security` commit status + posts a REQUEST_CHANGES review). |
 | `neurosploit-mention.yml` | Comment **`@neurosploit`** on a PR/issue (writers only) to trigger a scan. Text after the mention steers it, in any language; a URL runs a black-box test, otherwise it reviews the PR. |
+| `ci.yml` | Rust CI for the `neurosploit-rs/` workspace — `cargo build` / `test` / `clippy -D warnings` on every push & PR. |
 
 ## Enforce the PR gate as a merge block
 

examples/github-actions/ci.yml

@@ -0,0 +1,52 @@
+# NeuroSploit — Rust CI
+#
+# Build, test and lint the `neurosploit-rs/` Cargo workspace on every push and
+# pull request. Copy to `.github/workflows/ci.yml` in your fork to enable it.
+#
+# Note: this lives here (not in `.github/workflows/`) as a template — like the
+# other files in this folder — so the upstream repo doesn't run it on itself.
+
+name: ci
+
+on:
+  push:
+    branches: [main]
+    paths: ["neurosploit-rs/**", ".github/workflows/ci.yml"]
+  pull_request:
+    paths: ["neurosploit-rs/**"]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  build-test:
+    name: build & test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: neurosploit-rs
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        run: rustup toolchain install stable --profile minimal --component clippy
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            neurosploit-rs/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('neurosploit-rs/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Build
+        run: cargo build --workspace --locked
+
+      - name: Test
+        run: cargo test --workspace --locked
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings