fix(reentrancy): make GuardCount unforgeable, widen the local rustdoc gate

`GuardCount` was a fieldless unit struct, so any code able to name it could
construct one -- and therefore drop one. `Drop` decrements the thread-local,
so a stray `drop(GuardCount)` while a tracked guard was live took the count to
zero, `assert_no_guards_held` then passed, and a genuine callback-under-lock
went unreported. `saturating_sub` made that desync permanently silent. A
private field means only this module can mint one, so the count moves only by
acquiring and releasing a real guard. The module docs called it a unit struct;
they now say zero-sized newtype.

`check-local.nu`'s rustdoc gate matched only `unresolved link`, while
`check-local.sh:95` -- what CI runs -- also matches `broken_intra_doc_links`.
A diagnostic carrying the lint name but not that phrase passed locally and
failed remotely, which is the specific way this gate has already wasted CI
cycles on this branch series. Both patterns now, as the shell gate does.

No behaviour change: the four `reentrancy::tests` still pass, including
`assert_fires_while_a_guard_is_live`, which is the one that proves the counter
still detects.

Author: YuanYuYuan

crates/hiroz/src/reentrancy.rs

@@ -31,8 +31,8 @@
 //!
 //! # Cost
 //!
-//! Zero in release. [`GuardCount`](crate::reentrancy::GuardCount) is a unit
-//! struct whose constructor and `Drop` compile to nothing without
+//! Zero in release. [`GuardCount`](crate::reentrancy::GuardCount) is a
+//! zero-sized newtype whose constructor and `Drop` compile to nothing without
 //! `debug_assertions`, and
 //! [`assert_no_guards_held`](crate::reentrancy::assert_no_guards_held)
 //! expands to nothing. Tests and CI run in debug, which is where the assertion
@@ -57,15 +57,24 @@ thread_local! {
 }
 
 /// RAII counter embedded in every tracked guard.
+///
+/// The private field is what makes the counter trustworthy. As a fieldless unit
+/// struct this was constructible — and therefore *droppable* — by any code that
+/// could name it, and `Drop` decrements the thread-local. A stray
+/// `drop(GuardCount)` while a tracked guard was live would take the count to
+/// zero, `assert_no_guards_held` would pass, and a genuine callback-under-lock
+/// would go unreported. `saturating_sub` guaranteed that desync was silent.
+/// Only this module can mint one now, so the count can only be moved by
+/// acquiring and releasing a real guard.
 #[derive(Debug)]
-pub struct GuardCount;
+pub struct GuardCount(());
 
 impl GuardCount {
     #[inline(always)]
     fn new() -> Self {
         #[cfg(debug_assertions)]
         LIVE_GUARDS.with(|n| n.set(n.get() + 1));
-        Self
+        Self(())
     }
 }
 

scripts/check-local.nu

@@ -83,7 +83,7 @@ def main [--suite: string = "full"] {
         {name: "hu clippy (check-hu)", cmd: "nu scripts/test-pure-rust.nu check-hu"},
         {name: "SHM tests (test-shm)", cmd: "nu scripts/test-pure-rust.nu test-shm"},
         {name: "Distro feature flags (check-distro-features)", cmd: "nu scripts/test-pure-rust.nu check-distro-features"},
-        {name: "Rustdoc links (cargo doc)", cmd: "let r = (^cargo doc --no-deps -p hiroz --quiet | complete); let w = ($r.stderr | lines | where $it =~ 'unresolved link'); if ($w | is-not-empty) { print ($w | str join (char newline)); error make {msg: 'rustdoc: unresolved intra-doc links'} }"},
+        {name: "Rustdoc links (cargo doc)", cmd: "let r = (^cargo doc --no-deps -p hiroz --quiet | complete); let w = ($r.stderr | lines | where {|it| ($it =~ 'unresolved link') or ($it =~ 'broken_intra_doc_links')}); if ($w | is-not-empty) { print ($w | str join (char newline)); error make {msg: 'rustdoc: unresolved intra-doc links'} }"},
     ]
 
     let results = $checks | enumerate | each {|item|