build: ./check — canonical verification gate for CUBELinux-2

The workspace had no single verification entrypoint, so every claim of
'green' rested on an ad-hoc command chosen after the fact. ./check makes it
one command, mirroring the convention already used by the original build.

  ./check          fmt + tests + clippy -D warnings
  ./check quick    tests only
  ./check mount    the above + live FUSE end-to-end (root, 27 assertions)

The FUSE adapter compiles in every stage (--features cubefs/mount) so the
kernel-facing code can never silently rot behind a feature flag. The live
mount stage is opt-in because it needs root, /dev/fuse and attr — but it is
the only stage that exercises the real kernel VFS path, and it encodes the
two Package 3 regressions (mkdir -p to depth 4, cross-user ACLs) that every
unit test missed.

Adopting clippy -D warnings immediately paid for itself: it failed on two
pre-existing Package 1 defects that per-crate greps had let through —
a needless_range_loop in TriEnc::unpack_6 and a doc comment orphaned by a
blank line in HeaderFlags. Both fixed.

Verified: ./check green; ./check mount green (27/27, no leftover mounts).

cubecoords/src/lib.rs

@@ -155,9 +155,8 @@ impl TriEnc {
         let v = word.0;
         let control = ((v >> 60) & 0x0F) as u8;
         let mut ascii = [0u8; 6];
-        for i in 0..6 {
-            let shift = 8 * (5 - i);
-            ascii[i] = ((v >> shift) & 0xFF) as u8;
+        for (i, b) in ascii.iter_mut().enumerate() {
+            *b = ((v >> (8 * (5 - i))) & 0xFF) as u8;
         }
         (control, ascii)
     }
@@ -186,8 +185,8 @@ impl HeaderFlags {
     pub const PERM_REMOTE_USER: u16 = 1 << 6;
     /// Flag 8: has outgoing association links.
     pub const HAS_ASSOCIATIONS: u16 = 1 << 7;
-    /// Flag 255 (conceptual end-of-header) is represented out-of-band by the
-    /// record serializer; there is no bit for it.
+    // Flag 255 (conceptual end-of-header) is represented out-of-band by the
+    // record serializer; there is no bit for it.
 
     /// Construct from a raw bitmask.
     #[inline]