Add Rust and Cargo provider

[markoa]

Detect Cargo projects and emit an evidence-backed plan for setup, build, test, and lint.

Rebased onto latest main (Composer PHP provider). The README supported list now includes both stacks: Rust and Cargo alongside PHP, Laravel, Symfony, and Composer.

This follows the Go provider’s convention-first model:

• Discover Cargo.toml as a project root
• Report rust / cargo, workspace roots (including dotted workspace.members keys), and well-known frameworks (axum, actix-web, rocket), including renamed crates, axum.workspace = true, and inherited workspace aliases such as web.workspace = true → package = "axum", with evidence on both the member declaration and the workspace package value
• Read rust-version as an MSRV (>=N) from Cargo.toml, plus exact pins from rust-toolchain / rust-toolchain.toml (including files that start with comments, dotted toolchain.channel assignments, and inline toolchain = { channel = ... } tables) and .tool-versions. A plain rust-version file is not a rustup pin.
• For rust-version.workspace = true, attach member-inheritance evidence and the workspace declaration that supplies the value
• Conflict exact toolchain pins that are older than Cargo rust-version, disagreeing exact pins, and a non-matrix CI toolchain that contradicts a numeric exact pin even when it satisfies the MSRV
• Treat symbolic channels (stable, nightly) as unevaluable so a numeric CI toolchain can still fold into the MSRV range
• Infer cargo fetch, cargo test (when real tests exist — #[test] attributes or Cargo tests/ targets, not _test.rs filenames, comments, strings, or quote character literals), and cargo build
• Report Clippy, rustfmt, nextest, and cargo-deny config without inventing commands; the renderer reports a configured tool only when no command invokes it, including through declared wrappers such as npm run lint → ESLint
• Interpret Cargo invocations in CI, including global options before the subcommand (cargo --locked test, cargo -Zunstable-options check); treat rustup, rustc -V/-vV, and remote cargo install as plumbing
• Recognize dtolnay/rust-toolchain, actions-rs/toolchain, and actions-rust-lang/setup-rust-toolchain (including that action’s stable default and expression-valued toolchain-file inputs)
• Preserve observed --manifest-path invocations exactly (Cargo reads .cargo/config.toml from the original working directory)
• Preserve cargo -C when the statement has redirects or pipes so shell-relative paths stay at the original cwd; rewrite -C only for simple commands
• Leave the original --manifest-path / -C text intact when Semaphore cannot relocate to that directory during static inspection (for example a path generated by an earlier CI step)
• Leave variable- or expression-valued Cargo paths unresolved with the original command intact

Goldens cover rust-simple, rust-gha, rust-workspace, and clap-rs/clap at a pinned commit.

Rust was previously listed as post-v0; idea.md and plan.md now include it alongside the milestone 7 language work.