#228 perf(ci): prebake pinned Rust toolchain

Bakes the repository-pinned Rust 1.97 toolchain into stock and official runner goldens, verifies the exact toolchain plus rustfmt/clippy, removes redundant CI rustup and apt installs, and enables Cargo caching for property jobs. Also refreshes the stale dtolnay action pin required by zizmor.

---

Summary by cubic

Prebakes the repository-pinned Rust 1.97 toolchain into stock Ubuntu and official runner goldens so CI jobs no longer install it on every run.

• Removes per-job rustup and apt installs in CI workflows and enables Cargo caching on additional jobs.
• Official runner snapshots now receive the pinned toolchain layers while their existing packages are left untouched.
• Toolchain verification now checks rustc, rustfmt, and clippy via rustup instead of only the cargo binary.
• The curated Rust version moves from a hardcoded 1.88.0 to rust_toolchain_version in versions.toml, so bumping it invalidates the golden fingerprint.
• Refreshes the stale dtolnay/rust-toolchain action pin required by zizmor.