[kvlonge]

Why

Fresh orbs need a reproducible toolchain and locked native development environment without manual bootstrap steps.

Changes

• Add an executable setup script for stable Rust with Clippy/rustfmt, Python 3.12 and locked uv dependencies across all groups and extras.
• Persist Cargo paths and a worktree-specific external target directory for later login shells.
• Keep normal Cargo parallelism and ignore generated portal metadata.

Verification

• Isolated cold setup and warm second run passed with empty initial toolchain, dependency, virtualenv and Cargo caches; no OOM or jobs cap.
• Clean-login environment, native import and real DuckDB planning smoke passed.
• Bash syntax validation and the exact all-extras static CI target passed.