ci: serialize Rust toolchain bootstrap

[vicondoa]

Summary

The trusted main build workflow now prepares the pinned Rust toolchain before make check starts its parallel Layer-1 jobs. This prevents concurrent rustup downloads from corrupting the shared runner installation and causing Rust/proof lanes to fail with missing tools.

The workflow also tolerates GitHub runs that omit reusable-workflow job metadata for same-repository calls. When GitHub provides that metadata, the workflow still requires the protected main ref and a full immutable SHA. The policy test binds those checks to the helper body and to both accepted event paths.

This is a follow-up to the landed BuildBuddy workflow change. It does not modify v3 or use PR #473 as the vehicle.

Related: #474

Validation

• cargo test --manifest-path packages/Cargo.toml -p xtask --test policy_ci - 3 passed.
• make test-lint - passed.
• make test-policy - passed.
• YAML parsing, pinned Rust bootstrap, and git diff --check - passed.
• CodeQL and all main-required PR checks (check, eval, eval-shell-tests) - passed.
• Fresh independent review after the final policy-test fix - no P0/P1 findings.

Bootstrap note

The build / metadata and build / check runs shown on this PR are sourced from the pre-fix workflow on default main, as required by pull_request_target; they therefore retain the old job_workflow_ref failure until this fix lands. The corrected workflow will be exercised by the post-merge main push run. No merge bypass or policy change is used.

Security and trust boundaries

PR workflows remain credential-free and main-controlled. The change preserves immutable tested base/head/merge OID checks, pinned actions, local-only Nix/fixture/hardware behavior, the push-only BuildBuddy credential gate, descriptor-based credential handling, redaction, warning fail-closed behavior, and the stable aggregate build / check context.