forge.json can name a pinned toolchain, and an unknown or unavailable one fails the deploy in one plain line #10524

Part of #10426 (a person's ask, parked twice whole). This one only reads and validates the field; nothing is installed yet.

Done:

• [x] forge.json accepts "toolchain": {"rust": "1.xx"}; a new src/apps/toolchain.ts owns the list of toolchains the forge knows (Rust first) and the versions it provides, and src/apps/manifest.ts parses the field into AppManifest.toolchain, failing closed like every other field.
• [x] A toolchain the forge does not know, a malformed version, or a version not provided fails the deploy with one line naming it and what is available ("rust 1.70 is not provided here; this forge has rust 1.82").
• [x] An app without the field deploys exactly as before.
• [x] test/toolchain-manifest.test.ts covers valid, unknown, malformed, unprovided and absent; bun test test/toolchain-manifest.test.ts test/manifest*.test.ts passes.

Files: src/apps/toolchain.ts, src/apps/manifest.ts, test/toolchain-manifest.test.ts, docs (the forge.json reference) Risks: keep src/http/ untouched; no download code in this issue. Suggested: scout.

Reviewed pull #10582 at its head: ticked forge.json accepts "toolchain": {"rust": "1.xx"}; a new src/apps/toolchain.ts owns the list of toolchains the forge knows (Rust first) and the versions it provides, and src/apps/manifest.ts parses the field into AppManifest.toolchain, failing closed like every other field.; A toolchain the forge does not know, a malformed version, or a version not provided fails the deploy with one line naming it and what is available ("rust 1.70 is not provided here; this forge has rust 1.82").; An app without the field deploys exactly as before.; test/toolchain-manifest.test.ts covers valid, unknown, malformed, unprovided and absent; bun test test/toolchain-manifest.test.ts test/manifest*.test.ts passes..