Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/execpolicy/src/arg_resolver.rs

@@ -45,7 +45,12 @@ pub fn resolve_observed_args_with_patterns(
     let prefix = get_range_checked(&args, 0..num_prefix_args)?;
     let mut prefix_arg_index = 0;
     for pattern in prefix_patterns {
-        let n = pattern.cardinality().is_exact().unwrap();
+        let n = pattern
+            .cardinality()
+            .is_exact()
+            .ok_or(Error::InternalInvariantViolation {
+                message: "expected exact cardinality".to_string(),
+            })?;
         for positional_arg in &prefix[prefix_arg_index..prefix_arg_index + n] {
             let matched_arg = MatchedArg::new(
                 positional_arg.index,
@@ -111,7 +116,12 @@ pub fn resolve_observed_args_with_patterns(
     let suffix = get_range_checked(&args, initial_suffix_args_index..args.len())?;
     let mut suffix_arg_index = 0;
     for pattern in suffix_patterns {
-        let n = pattern.cardinality().is_exact().unwrap();
+        let n = pattern
+            .cardinality()
+            .is_exact()
+            .ok_or(Error::InternalInvariantViolation {
+                message: "expected exact cardinality".to_string(),
+            })?;
         for positional_arg in &suffix[suffix_arg_index..suffix_arg_index + n] {
             let matched_arg = MatchedArg::new(
                 positional_arg.index,

codex-rs/execpolicy/src/policy_parser.rs

@@ -168,6 +168,8 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
                 .map(|v| v.items.to_vec())
                 .collect(),
         );
+
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()
@@ -182,6 +184,7 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
         strings: UnpackList<String>,
         eval: &mut Evaluator,
     ) -> anyhow::Result<NoneType> {
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()
@@ -197,6 +200,7 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
         reason: String,
         eval: &mut Evaluator,
     ) -> anyhow::Result<NoneType> {
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()