fix(image): let rustup own the rust surface, and carry its channels to the builder

[rldyourmnd]

Both live attempts to build b19 died five minutes in, at the rustup step, with an empty result and nothing on stderr. The preserved builder shows why, and it is three coupled defects, not one:

1. The guest projection dropped the channels. guestToolchain carried name/version/archive/sha only; channels and default_channel existed in the manifest, were guarded by manifest tests, and never reached provision.sh — whose bare [[ ${#rust_channels[@]} -gt 0 ]] then killed the build silently under set -e.
2. Neither smoke script knew rustup. The provision sets were extended in feat(image): bake rustup and the channels the estate pins, and add bubblewrap #315; the smoke sets were not, so a build that survived provisioning would have failed smoke on the set comparison.
3. The standalone rust 1.97.1 could not survive its own recipe. The rustup shims overwrite /usr/local/bin/rustc during provisioning, so smoke's rustc 1.97.1 expectation could never hold in the shipped image — the tarball promised a toolchain the image destroys in place.

The change makes rustup the single owner of the Rust surface:

• manifests drop the standalone rust tarball; BakedToolchains() follows;
• default channel 1.98.0 serves PATH callers; 1.89 (MSRV) rides beside it, both with clippy and rustfmt — the exact channels the seven public setup-systems pin;
• provision.sh reports a dropped-channels contract instead of dying silently;
• both smoke scripts verify every pinned channel, the default through the shims, ownership of RUSTUP_HOME/CARGO_HOME, and /etc/environment;
• the projection into the guest contract is one function, guestToolchainFromPlan, with a test that fails when a field is dropped;
• the benchmark installer follows the image to 1.98.0.

make verify (fmt, vet, race, build) passes. Recipe and manifest fingerprint goldens moved with the recipe, as they should.

https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF