An app that names Rust gets cargo on its install, test and run steps from a pinned cached toolchain, and a Rust hello-world app serves #10592

An app that pins toolchain.rust in forge.json now gets cargo and rustc on its install, test and run steps. Apps that don't name it see nothing. bun scripts/gate.ts and tsc are clean. The new tests pass except the real-cargo hello-world test, which skipped because this sandbox has no cargo. The forge's check on the push is the first place it can run for real.

What changed

• Toolchain location: it lives in $FORGE_TOOLCHAINS/rust/<version>/, mounted read-only into the cell. I chose a plain directory over a nix store path because it needs no daemon and no new dependency. The reasoning is in docs/features/toolchains.md.
• Environment: toolchainUse in src/apps/toolchain.ts puts the toolchain's bin/ first on PATH. It sets RUSTUP_HOME to the read-only toolchain and CARGO_HOME to a writable .cargo in the environment's home, so the toolchain itself is never written. It does no network work.
• Wiring: src/apps/process.ts applies this to the install step, the test step and the app's run command, and shows the toolchain directory read-only in each cell.
• Missing toolchain: a pin the host lacks fails the install stage with "rust 1.82 is pinned but not installed on this host".
• Fixture: test/fixtures/rust-hello/ is a forge.json with toolchain.rust, an install of cargo build --release --offline, and a std-only binary that serves $PORT.
• Docs: docs/features/toolchains.md says how an admin adds a Rust version, and docs/APPS.md now points to it.

Tests (test/toolchain-rust.test.ts)

• The environment values are exact.
• Two deploys with fetch stubbed make no non-loopback fetch.
• An app that doesn't name rust has no toolchain on PATH.
• A missing toolchain gives the one-line error.
• The hello-world test builds the fixture and checks / answers. Where cargo is absent it is skipped by name, never passed.

What I left out

• Installing a toolchain. An admin does that by hand, and adding a version means editing TOOLCHAINS.rust in src/apps/toolchain.ts.
• Dependency fetching for Rust apps beyond their declared egress.
• A deploy-time check that rustup/ exists.
• A cell-level test that the toolchain mount is read-only. It relies on the existing reveal read-only bind, and cell suites are skipped in this sandbox.

To try it, unpack a Rust release to $FORGE_TOOLCHAINS/rust/1.82, then deploy test/fixtures/rust-hello.

Closes #10525

An app that pins toolchain.rust in forge.json now gets cargo and rustc on its install, test and run steps. Apps that don't name it see nothing. bun scripts/gate.ts and tsc are clean. The new tests pass except the real-cargo hello-world test, which skipped because this sandbox has no cargo. The forge's check on the push is the first place it can run for real.

What changed

• Toolchain location: it lives in $FORGE_TOOLCHAINS/rust/<version>/, mounted read-only into the cell. I chose a plain directory over a nix store path because it needs no daemon and no new dependency. The reasoning is in docs/features/toolchains.md.
• Environment: toolchainUse in src/apps/toolchain.ts puts the toolchain's bin/ first on PATH. It sets RUSTUP_HOME to the read-only toolchain and CARGO_HOME to a writable .cargo in the environment's home, so the toolchain itself is never written. It does no network work.
• Wiring: src/apps/process.ts applies this to the install step, the test step and the app's run command, and shows the toolchain directory read-only in each cell.
• Missing toolchain: a pin the host lacks fails the install stage with "rust 1.82 is pinned but not installed on this host".
• Fixture: test/fixtures/rust-hello/ is a forge.json with toolchain.rust, an install of cargo build --release --offline, and a std-only binary that serves $PORT.
• Docs: docs/features/toolchains.md says how an admin adds a Rust version, and docs/APPS.md now points to it.

Tests (test/toolchain-rust.test.ts)

• The environment values are exact.
• Two deploys with fetch stubbed make no non-loopback fetch.
• An app that doesn't name rust has no toolchain on PATH.
• A missing toolchain gives the one-line error.
• The hello-world test builds the fixture and checks / answers. Where cargo is absent it is skipped by name, never passed.

What I left out

• Installing a toolchain. An admin does that by hand, and adding a version means editing TOOLCHAINS.rust in src/apps/toolchain.ts.
• Dependency fetching for Rust apps beyond their declared egress.
• A deploy-time check that rustup/ exists.
• A cell-level test that the toolchain mount is read-only. It relies on the existing reveal read-only bind, and cell suites are skipped in this sandbox.

To try it, unpack a Rust release to $FORGE_TOOLCHAINS/rust/1.82, then deploy test/fixtures/rust-hello.

Left #10525 open: 1 unticked item remain (A fixture Rust hello-world app (forge.json with toolchain.rust, a cargo build in install, a binary that serves $PORT) deploys and answers / in a test.).