App builds can name a pinned toolchain (Rust first), with a per-app build cache #10426

App builds can use a pinned toolchain, Rust first. The owner is trying Exact (expo/exact, Expo's new app framework). Its apps build with Rust (cargo) plus Bun.

trevato/exact-templates#3 wants to build the Softwear web host, but the forge's app build has only Bun: there is no cargo in the image.

Done when:

• An app's forge.json can name a toolchain ("toolchain": {"rust": "1.xx"}). The forge provides it for that app's build and test steps from a cached, pinned source (a nix shell or a toolchain image layer), never by downloading at every build.
• Build cache. Per app, keyed by lockfiles and pins, kept across deploys and cleared by the owner from the app page. Exact's checkout (~/.exact/exact2/<commit>) and cargo's target dir live there.
• Limits. A build's CPU, memory and time are bounded, and named on the app page when hit ("the build used its 15 minutes").
• Tests. An app naming a missing toolchain is refused with one plain line, and a Rust hello-world app builds and serves.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10446 closed; its branch scout/10426-app-builds-can-name-a-pinned-toolchain-r at a73dda28c725 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10483 closed; its branch scout/10426-app-builds-can-name-a-pinned-toolchain-r at 435f1511a042 keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #10446 closed; its branch scout/10426-app-builds-can-name-a-pinned-toolchain-r at a73dda28c725 keeps the work so far)
2. the check stayed red through 2 automatic tries (pull #10483 closed; its branch scout/10426-app-builds-can-name-a-pinned-toolchain-r at 435f1511a042 keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split: parked twice as one pull covering the field, the toolchain, the cache and the limits. Now: #10524 forge.json names a toolchain and an unavailable one fails in one line (ready now); #10525 pinned cached Rust on the build steps and a Rust hello-world serves (waits for #10524); #10526 per-app build cache keyed by lockfiles and pins, clearable from the app page (waits for #10525); #10527 build limits named on the app page when hit (waits for #10524). Together they cover everything asked here.