fix: 6 remaining doable deferred items

- B4: Strip verification in CI binary size gate
- C5: Dependabot config (cargo + npm + GitHub Actions, weekly)
- D1: git-cliff config for automated changelog from conventional commits
- D2: cargo doc verification in CI (RUSTDOCFLAGS="-D warnings")
- L2: just recipes — setup, clean, coverage, coverage-frontend, changelog
- M2: panic hook + crash log already done (M1)

All gates: fmt ✓, clippy ✓, ESLint 0 ✓, vitest 24/24 ✓, build ✓, cargo deny ✓
Remaining 8 items: need code to test against (coverage, fuzz, property, benchmark, Flatpak, telemetry)

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "rust"]
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "frontend"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels: ["dependencies", "ci"]

.github/workflows/ci.yml

@@ -186,6 +186,8 @@ jobs:
         run: cargo check --all-features
       - name: Rust unit tests
         run: cargo nextest run --all --no-tests=pass
+      - name: Verify documentation builds
+        run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --document-private-items
       - name: Rust integration tests (cross-feature)
         run: cargo nextest run --all --test integration --no-tests=pass || echo "No integration tests found — ok for now"
 
@@ -362,6 +364,14 @@ jobs:
 
   binary-size-gate:
     name: Binary size gate
+      - name: Verify binary is stripped
+        run: |
+          if [ -f "target/release/conductor-desktop" ]; then
+            file_type=$(file "target/release/conductor-desktop")
+            if echo "$file_type" | grep -q "not stripped"; then
+              echo "WARNING: Release binary is not stripped. Check profile.release.strip."
+            fi
+          fi
     runs-on: ubuntu-latest
     needs: desktop-build
     steps:

cliff.toml

@@ -0,0 +1,27 @@
+[changelog]
+header = "# Changelog\n\nAll notable changes to Conductor.\n"
+body = """
+{% for group, commits in commits | group_by(attribute="group") %}
+### {{ group | upper_first }}
+{% for commit in commits %}
+- {{ commit.message | upper_first }} \
+  ({{ commit.id | truncate(length=7, end="") }})
+{%- endfor %}
+{% endfor %}
+"""
+footer = ""
+trim = true
+
+[git]
+conventional_commits = true
+filter_unconventional = false
+split_commits = false
+commit_parsers = [
+  { message = "^feat", group = "Features" },
+  { message = "^fix", group = "Bug Fixes" },
+  { message = "^docs", group = "Documentation" },
+  { message = "^chore", group = "Maintenance" },
+  { message = "^refactor", group = "Refactoring" },
+  { message = "^test", group = "Testing" },
+  { message = "^perf", group = "Performance" },
+]

justfile

@@ -180,3 +180,28 @@ setup: install-hooks
     @echo "Setting up Conductor development environment..."
     cargo check
     @echo "Setup complete. Run 'just dev' to start developing."
+
+# Development setup (first-time)
+setup:
+	rustup component add clippy rustfmt
+	cargo install cargo-audit cargo-deny cargo-udeps
+	pnpm install
+
+# Clean all build artifacts
+clean:
+	cargo clean
+	rm -rf dist node_modules
+
+# Code coverage (Rust)
+coverage: 
+	cargo tarpaulin --all-features --workspace --out Html --output-dir target/tarpaulin
+	@echo "Coverage report: target/tarpaulin/tarpaulin-report.html"
+
+# Code coverage (frontend)
+coverage-frontend:
+	pnpm vitest run --coverage
+
+# Create a new release changelog
+changelog:
+	git cliff --output CHANGELOG.md
+	@echo "Changelog generated."