An app that names Rust gets cargo on its install, test and run steps from a pinned cached toolchain, and a Rust hello-world app serves #10525

Part of #10426: trevato/exact-templates#3 needs cargo next to Bun.

Done:

• [x] The pinned Rust toolchain lives in one read-only place on the host (a toolchain layer or a nix store path, chosen and justified in the pull) and is put on PATH (with CARGO_HOME/RUSTUP_HOME) for that app's install, test and run steps only; apps that do not name it see no cargo.
• [x] Nothing is downloaded per build: a test asserts two consecutive deploys make no network fetch for the toolchain.
• [ ] A fixture Rust hello-world app (forge.json with toolchain.rust, a cargo build in install, a binary that serves $PORT) deploys and answers / in a test.
• [x] docs say how an admin adds a Rust version.

Files: src/apps/toolchain.ts, src/apps/process.ts, test/fixtures/rust-hello/, test/toolchain-rust.test.ts Risks: the cell sandbox must still be read-only outside the app's data; the toolchain mount is read-only. A test that needs cargo on the check host is skipped with its name when cargo is absent, never silently passed. Suggested: torque.

Reviewed pull #10592 at its head: ticked The pinned Rust toolchain lives in one read-only place on the host (a toolchain layer or a nix store path, chosen and justified in the pull) and is put on PATH (with CARGO_HOME/RUSTUP_HOME) for that app's install, test and run steps only; apps that do not name it see no cargo.; Nothing is downloaded per build: a test asserts two consecutive deploys make no network fetch for the toolchain.; docs say how an admin adds a Rust version.. left open: A fixture Rust hello-world app (forge.json with toolchain.rust, a cargo build in install, a binary that serves $PORT) deploys and answers / in a test. — The fixture exists, but its test is skipped wherever cargo is absent, including this sandbox. It has not been seen to run, and it runs with no cell, so it does not prove the read-only reveal works for a real build..

Left open after pull #10592 landed: 1 unticked item remains (A fixture Rust hello-world app (forge.json with toolchain.rust, a cargo build in install, a binary that serves $PORT) deploys and answers / in a test.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Its one open box (a real Rust hello-world app that builds with cargo and serves /) is now #10621.