fix(rust-supply-chain): install toolchain before cargo audit/machete

[rldyourmnd]

Summary

The audit and machete jobs in rust-supply-chain.yml ran cargo <tool> with no Rust toolchain setup: the toolchain input (default stable) existed but was never consumed by a step. The jobs passed only where a toolchain happened to be ambient on the runner image — ubuntu-latest and some self-hosted slots — and failed with cargo: command not found where it was not (observed: nddev-linux runner slot gha-runner-2, NDDev-it-com/setup-systems#320, two consecutive runs).

Both jobs now install actions-rust-lang/setup-rust-toolchain with the declared toolchain input before taiki-e/install-action. Caller interface unchanged; deny is untouched (Docker action, no cargo needed).

Type of change

• Fix to an existing workflow

Threat-model note

The new step runs actions-rust-lang/setup-rust-toolchain@166cdcfd (v1.17.0), already registered in catalog/tools.yml and used by five workflows in this tree (rust-ci, benchmark, benchmark-compare, fuzzing, mutation-testing). It installs a rustup toolchain under the caller-declared toolchain input — a workflow_call input, so it is fixed by the caller's pinned commit, not attacker-controlled. No new egress endpoint, token scope, or secret exposure; used_by updated accordingly.

Permissions diff

No change. audit and machete keep contents: read; the added step needs none.

Checklist

• validate_all.py core: OK; touched: OK (change committed after scoping; the capability declares no expiring product facts)
• actionlint clean on the edited workflow
• zizmor@1.26.1 --persona pedantic --min-severity low with GH_TOKEN: no findings
• catalog/tools.yml used_by updated; generate_docs.py produced no drift
• CHANGELOG.md entry under [Unreleased]
• Full-tree validate_all.py shows product-facts-calendar FAIL on three expired facts (circleci-free, circleci-open-source, harness-free — expired 2026-09-17/18) — pre-existing scheduled-tier expiry, unrelated to this change