style: cargo fmt — settle comment/assert layout the last two fixes left unformatted

`cargo fmt --all --check` on main flags decode.rs (android dlsym fix),
probe/main.rs (0600 key fix), and session.rs (anti-replay tests). The probe
one is restructured rather than machine-formatted: rustfmt wanted the key-
permissions comment gutter-aligned to the trailing `// the certificate is
public` comment, so fold both into one block comment above the write instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/android/native/src/decode.rs

@@ -490,8 +490,9 @@ fn install_render_callback(
     let ud = Arc::into_raw(tracker.clone());
     // SAFETY: `codec.as_ptr()` is the live codec this thread owns; `ud` outlives the registration
     // (reclaimed only after the codec is deleted, per this function's contract).
-    let status =
-        unsafe { set_on_frame_rendered(codec.as_ptr(), Some(on_frame_rendered), ud as *mut c_void) };
+    let status = unsafe {
+        set_on_frame_rendered(codec.as_ptr(), Some(on_frame_rendered), ud as *mut c_void)
+    };
     if status == ndk_sys::media_status_t::AMEDIA_OK {
         Some(ud)
     } else {

clients/probe/src/main.rs

@@ -157,9 +157,10 @@ fn load_or_create_identity() -> Result<(String, String)> {
     }
     let (c, k) = endpoint::generate_identity().map_err(|e| anyhow!("generate identity: {e}"))?;
     std::fs::create_dir_all(&dir)?;
-    std::fs::write(&cp, &c)?; // the certificate is public
-    // The key is the mTLS credential a paired host authorizes for full remote control, so it must
-    // not be world-readable — create it 0600 (a plain `fs::write` honors the umask → typically 0644).
+    // The certificate is public; the key is the mTLS credential a paired host authorizes for full
+    // remote control, so it must not be world-readable — create it 0600 (a plain `fs::write`
+    // honors the umask → typically 0644).
+    std::fs::write(&cp, &c)?;
     #[cfg(unix)]
     {
         use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};

crates/punktfunk-core/src/session.rs

@@ -493,7 +493,10 @@ mod replay_tests {
         assert!(w.accept(80));
         assert!(!w.accept(80), "second copy of a reordered seq is a replay");
         assert!(w.accept(99));
-        assert!(!w.accept(100), "the high-water seq itself can't be replayed");
+        assert!(
+            !w.accept(100),
+            "the high-water seq itself can't be replayed"
+        );
     }
 
     #[test]
@@ -515,7 +518,10 @@ mod replay_tests {
         // must read as unseen afterward, i.e. the jump cleared it — so a NEW seq there is accepted.
         let far = 10 * REPLAY_WINDOW + 5;
         assert!(w.accept(far));
-        assert!(!w.accept(5), "the pre-jump seq is now far older than the window");
+        assert!(
+            !w.accept(5),
+            "the pre-jump seq is now far older than the window"
+        );
         // A fresh seq aliasing 5 (mod WINDOW) but inside the new window is accepted, proving the
         // stale bit was cleared rather than mistaken for a replay.
         assert!(w.accept(far - REPLAY_WINDOW + 1));