ci: add build workflow; reject unknown args; make audio probe opt-in

GitHub Actions built only on tag pushes, so nothing verified that main
compiles. Adds ci.yml running check, unit tests, clippy and a release
build on Linux, plus a Windows MSYS2 build, with both binaries uploaded
as artifacts.

Two issues would have made that workflow hang or fail:

- Unknown CLI arguments fell through the dispatch match into the global
  hotkey loop, so `scythe --version` (a typo, or any unrecognised flag)
  silently became a background hotkey daemon that never exited. Unknown
  arguments now report the flag and exit 2.
- test_audio_probe asserts that a system audio device opens and emits
  samples. Headless runners have no audio server, so the suite could
  never pass in CI. The test is now opt-in via SCYTHE_HW_TESTS=1 and
  still runs on a real desktop session.

.github/workflows/ci.yml

@@ -0,0 +1,113 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+
+jobs:
+  build-linux:
+    name: Linux (check, test, build)
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install System Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            pkg-config clang libva-dev \
+            libavcodec-dev libavformat-dev libavutil-dev \
+            libswresample-dev libswscale-dev libavfilter-dev libavdevice-dev \
+            libpipewire-0.3-dev libxcb1-dev libxcb-shm0-dev libxcb-xfixes0-dev \
+            libasound2-dev
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: linux-${{ hashFiles('Cargo.lock') }}
+          restore-keys: linux-
+
+      - name: Format check (advisory)
+        continue-on-error: true
+        run: cargo fmt --check
+
+      - name: Type check
+        run: cargo check --locked --all-targets
+
+      - name: Unit tests
+        run: cargo test --locked
+
+      - name: Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Build release
+        run: cargo build --locked --release
+
+      - name: Verify binary
+        run: |
+          ./target/release/scythe --help | head -3
+          test -x target/release/scythe
+          ls -la target/release/scythe
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: scythe-linux-x86_64
+          path: target/release/scythe
+          if-no-files-found: error
+
+  build-windows:
+    name: Windows (cross build)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup MSYS2
+        uses: msys2/setup-msys2@v2
+        with:
+          msystem: MINGW64
+          update: true
+          path-type: minimal
+          install: >-
+            mingw-w64-x86_64-toolchain
+            mingw-w64-x86_64-rust
+            mingw-w64-x86_64-ffmpeg
+            mingw-w64-x86_64-pkg-config
+            mingw-w64-x86_64-clang
+
+      - name: Build release
+        shell: msys2 {0}
+        env:
+          LIBCLANG_PATH: /mingw64/bin
+          BINDGEN_EXTRA_CLANG_ARGS: "--target=x86_64-w64-windows-gnu"
+        run: |
+          cargo build --release
+          ls -la target/release/scythe.exe
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: scythe-windows-x86_64
+          path: target/release/scythe.exe
+          if-no-files-found: error

src/capture/audio.rs

@@ -727,6 +727,13 @@ mod tests {
 
     #[test]
     fn test_audio_probe() {
+        // Requires a live PulseAudio/PipeWire or CoreAudio/WASAPI session. CI runners
+        // have no audio server, so this is opt-in rather than a hard assertion.
+        if std::env::var("SCYTHE_HW_TESTS").is_err() {
+            eprintln!("skipping test_audio_probe: set SCYTHE_HW_TESTS=1 to run hardware audio tests");
+            return;
+        }
+
         // 1. Test System audio
         let (tx, rx) = crossbeam_channel::unbounded();
         let sys_cap = AudioCapture::new_with_device_and_mode(tx, None, "system");

src/main.rs

@@ -577,7 +577,11 @@ fn run_client(args: Vec<String>) -> Result<(), Box<dyn std::error::Error + Send
                 println!("  scythe --quit         Stop background daemon");
                 return Ok(());
             }
-            _ => {}
+            other => {
+                eprintln!("scythe: unknown argument '{}'", other);
+                eprintln!("Run 'scythe --help' for usage.");
+                std::process::exit(2);
+            }
         }
     } else {
         ensure_daemon_running_async();