Rust CLI: port completion and _complete (shell completion)

.github/workflows/build.yml

@@ -193,7 +193,11 @@ jobs:
           components: rustfmt, clippy
       - run: cargo fmt --check
       - run: cargo clippy --locked --all-targets -- -D warnings
+      - name: Install completion test shells
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq --no-install-recommends bash zsh fish
       - run: cargo test --locked
+        env:
+          DW_REQUIRE_COMPLETION_SHELLS: '1'
       - run: cargo build --locked
       - name: Set up PHP for the 2.x compatibility vectors
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2

docs/release-notes/2.5.0.md

@@ -62,6 +62,7 @@ Every asset carries a GitHub build-provenance attestation. Linux binaries are st
 
 ## Intentional differences from 2.x
 
+- **Shell completion:** generating a script requires an executable name made of ASCII letters, digits, dots, underscores and hyphens, starting with a letter or underscore. Unsafe names are refused before any shell code is emitted. Completion debug logs now use a private `completion` directory alongside the CLI config file, and refuse unsafe log entries instead of following temporary-file links.
 - **Prompting without a terminal:** 2.x treated a non-terminal stdin as interactive and printed a "Do you want to run … instead?" prompt to stdout before exiting 1. 2.5.0 prompts only on a terminal; otherwise it reports the error on stderr, as 2.x did with `-n`.
 - **`--format=xml`:** this works in the standalone binary. The 2.x standalone binary failed with a PHP fatal error, because it lacked the DOM extension. The output matches the 2.x PHAR.
 - **IDs and names in request paths:** these are now percent-encoded. 2.x inserted workflow IDs, signal, query and update names and similar values into the URL unencoded, so a value containing `/`, `?`, `#`, `%` or a space reached the wrong route. Values made only of letters, digits and `-._~` are sent unchanged.

rust/build.rs

@@ -11,6 +11,12 @@ fn collect(dir: &Path, root: &Path, files: &mut Vec<(String, PathBuf)>) {
         .collect();
     entries.sort();
     for path in entries {
+        // Never follow a symlink out of schemas/.
+        let metadata = std::fs::symlink_metadata(&path)
+            .unwrap_or_else(|error| panic!("cannot stat {}: {error}", path.display()));
+        if metadata.file_type().is_symlink() {
+            continue;
+        }
         if path.is_dir() {
             collect(&path, root, files);
         } else if path