chore(v1.1.7): fix clippy --all-targets warnings

Clears the workspace under `clippy --all-targets --all-features
-D warnings`. Four were pre-existing at v1.1.6 HEAD (latent finding,
see HANDBACK): double_must_use on realtime_router, map_unwrap_or in
pubsub_service, redundant_closure in topic_repo, needless_raw_string in
a subscriber-token test. The rest are v1.1.7 nits (needless_borrow +
semicolon in the dead-letter / realtime-migration code).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/tests/sdk_subscriber_token.rs

@@ -197,7 +197,7 @@ async fn unit_ttl_uses_default() {
 async fn empty_topics_throws() {
     run_err(
         make_engine(),
-        r#"pubsub::subscriber_token([], 60)"#,
+        r"pubsub::subscriber_token([], 60)",
         request(AppId::new(), true),
     )
     .await;

crates/manager-core/src/dispatcher.rs

@@ -496,7 +496,7 @@ impl Dispatcher {
         // top of this function, so this fan-out is only reached for
         // non-handler executions.
         if let Some(dl_id) = dl_id {
-            self.fan_out_dead_letter(&row, &resolved, dl_id, &source, attempt, &err, now)
+            self.fan_out_dead_letter(row, resolved, dl_id, &source, attempt, &err, now)
                 .await;
         }
 

crates/manager-core/src/pubsub_service.rs

@@ -254,7 +254,7 @@ impl PubsubService for PubsubServiceImpl {
                 .get(cx.app_id, name)
                 .await
                 .map_err(|e| PubsubError::Unavailable(e.to_string()))?;
-            if !registered.map(|t| t.external_subscribable).unwrap_or(false) {
+            if !registered.is_some_and(|t| t.external_subscribable) {
                 return Err(PubsubError::SubscriberToken(format!(
                     "pubsub::subscriber_token: topic {name} is not externally subscribable"
                 )));

crates/manager-core/src/topic_repo.rs

@@ -195,7 +195,7 @@ impl TopicRepo for PostgresTopicRepo {
         .bind(app_id.into_inner())
         .bind(name)
         .bind(external_subscribable)
-        .bind(auth_mode.map(|m| m.as_str()))
+        .bind(auth_mode.map(TopicAuthMode::as_str))
         .fetch_optional(&self.pool)
         .await?;
         row.map(TopicRow::into_topic).transpose()

crates/orchestrator-core/src/realtime_api.rs

@@ -80,7 +80,6 @@ pub fn heartbeat_secs_from_env() -> u64 {
 }
 
 /// Router for the realtime SSE surface. Merged at the router root.
-#[must_use]
 pub fn realtime_router(state: RealtimeState) -> Router {
     Router::new()
         .route("/realtime/topics/{topic}", get(sse_topic))

crates/picloud/src/lib.rs

@@ -198,12 +198,14 @@ pub async fn build_app(
     // plaintext column is dropped in v1.1.8.
     match app_secrets_repo.migrate_plaintext_keys().await {
         Ok(0) => {}
-        Ok(n) => tracing::info!(
-            migrated = n,
-            "encrypted plaintext realtime signing keys at rest"
-        ),
+        Ok(n) => {
+            tracing::info!(
+                migrated = n,
+                "encrypted plaintext realtime signing keys at rest"
+            );
+        }
         Err(e) => {
-            tracing::error!(error = %e, "failed to encrypt realtime signing keys (continuing)")
+            tracing::error!(error = %e, "failed to encrypt realtime signing keys (continuing)");
         }
     }
     let realtime_authority: Arc<dyn RealtimeAuthority> = Arc::new(RealtimeAuthorityImpl::new(