code-slim (2026-10-26): formatted, warning-free portable code

Branch claude/code-slim-2026-10-26-slim, Linux cloud. No behaviour change except one dead-branch fix in a debug aid (below).

What changed

1. Format pass (first commits). Added Napple/.clang-format (the repo had none and repo-hygiene's was not in the base, so this is the file the integrator should keep one copy of): LLVM base, 4 spaces, attached braces, 160 columns, short functions/ifs/loops kept on one line, SortIncludes: Never, ReflowComments: false, BreakStringLiterals: false. Applied to runtime/src, audio, input, frontend and gfx/src/shader (.c/.h only; .m, .mm, frontend/src/fe_internal.h (Obj-C) and third-party left alone), one commit per area, then cargo fmt --all. Every reformatted C file is token-identical to its original once whitespace is removed (checked per file). Python was not formatted (not close to black style).
2. Warnings. Linux -Wall -Wextra (gcc and clang, -fsyntax-only with the tools/linux-check stubs, over every portable source and test): 17 distinct warnings before, 0 after (the stub-less implicit-function-declaration hits for Mach/dladdr calls are the stub gap, not code defects). Fixes: two unused functions removed, comment /* inside comments reworded, tautological test check dropped, unknown pragma guarded by __clang__, static inline for shared test helpers, a precedence warning parenthesised, a format-string call fixed, one misleading-indentation split. cargo clippy --workspace --all-targets -- -D warnings was red (about 20 findings) and is now clean: autofixes plus a handful of narrow #[allow]s, each with a one-line reason (too_many_arguments on new_sig and the test machine, new_ret_no_self on Slice::new, vec_init_then_push on the commented capability list, type_complexity in a test).
3. Dead code removed (each grepped across Makefiles, scripts, workflows, Package.swift, Cargo.toml, docs, assembly): maxwell_disassemble (empty stub, no declaration or caller), recip_estimate_int in a32_neon.c, want_id in ncm.c, the declarations of a32_describe and a32_op_name (never defined), tools/rescue_icloud.sh (one-off machine rescue, no references), the tracked tools/refpy/__pycache__/relr.cpython-314.pyc. Kept on purpose: runtime_hle_note, runtime_thread_returned, runtime_unresolved_call (called from .S thunks). No unused Cargo dependency found (each dependency name is referenced in its crate).
4. TODO/FIXME triage. Of the 34 grep hits, all but five are XXXXXX mkdtemp templates and similar false positives, 4 are upstream notes in the vendored nvn.h, 1 is real (mtl_tex.m, Obj-C, owned by mac-slim). All open items are in docs/todo.md.
5. Duplication. Script scan of 10-line windows: the only large duplicate is tinyjson.h (intentional copy guarded by a Makefile cmp), then small overlaps (tables.rs/tables32.rs, audin.c/audout.c) not worth a risky merge. No file split: fs.c has no Linux build, so a split could not be tested here.

Bug fix

runtime/src/services/hid.c emulate_load (NAPPLE_HID_TRACE only, Darwin only): two else if branches compared (in & mask) == 0x38400000 where the mask omitted bit 22, so they could never match (clang -Wtautological-compare). They now match 0x38000000 with opc != 0, mirroring the unsigned-offset branch. Encodings checked on Linux; not run on a Mac.

Counts

	before	after
Linux -Wall -Wextra warnings (unique, excl. stub gaps)	17	0
clippy -D warnings findings	~20	0
TODO/FIXME/XXX/HACK markers in own code	1 real (34 grep hits)	1 real, tracked in docs/todo.md
Lines (non-format commits)		197 added, 227 deleted
Lines (format commits)		+30.8k / -10.0k (C and Rust together) (wider layout of one-line statements; this is the cost of the user-requested pass)

Verified here

• sh tools/linux-check/run-tests.sh: 29 binaries, identical pass/fail lines before and after formatting and after the warning fixes (only the existing test_svc_time link failure, unchanged).
• make -C runtime build/host/test_ios_dylib: 10/10. The other test-host targets already failed to build on Linux before this branch (threads.c uses Mach), so make -C runtime test-host is not a Linux gate.
• cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all --check: green.
• Not run: make -C runtime test, test-services, make -C audio test, make -C input test, make -C gfx test, the four Testing Material titles (need macOS).