ci(TC-887): resolve the w5 workspace with --locked using a policy-engine deploy key

[samgbafa]

Part of TC-887 (encryption at rest): CI coverage for the separate w5 workspace's lockfile. Follows #332. Inert until a deploy key is added.

What changed

• New job w5-lockfile (.github/workflows/rust.yml): runs cargo metadata --locked --manifest-path test/w5-policy-runtime-node-e2e/Cargo.toml, the same real cargo resolve the other workspaces get. w5 depends on the private TinyCloudLabs/policy-engine by git, so the job needs a read-only deploy key for that repository in the POLICY_ENGINE_DEPLOY_KEY secret.
  • Without the secret (fork PRs, or until the key exists) it skips with a ::notice and passes.
  • permissions: contents: read. Checkout uses persist-credentials: false.
  • The key is loaded with ssh-add - from the step's env into an ssh-agent that lives only for the cargo step and is killed on exit. Then POLICY_ENGINE_DEPLOY_KEY is unset before cargo runs, because cargo can run an in-tree build.rustc-wrapper. A malformed key fails ssh-add with its message. The key never appears on argv or in output.
  • GitHub's published ED25519 host key is pinned in known_hosts, not scanned.
  • The SSH rewrite (url.<ssh>.insteadOf) is set through GIT_CONFIG_COUNT/KEY/VALUE for the cargo process only. It's anchored: before running, the step fails if any lockfile source shares the https://github.com/TinyCloudLabs/policy-engine prefix but is a different URL. The lockfile keeps its https source, so --locked is unaffected.
  • No toolchain action: rustup installs the rust-toolchain.toml pin (1.97.1) when cargo first runs.
  • The workflow comment states when the missing-secret skip should become a failure: once the key exists, for pushes and same-repository PRs. Fork PRs keep the skip.
• Known limitation, unchanged: cargo can't load tinycloud-node-server/tests/fixtures/email-claim-v1/rust standalone, because it sits under the tinycloud-node-server member and isn't its own workspace. A root exclude can't reach it there. The fixture's manifest is frozen by hash (pinned_email_claim_manifest_runs_all_negative_rows), so it stays as is; nothing needs to load it standalone today.

Needs (admin, not in this PR)

A read-only deploy key on TinyCloudLabs/policy-engine, with its private half stored as the POLICY_ENGINE_DEPLOY_KEY Actions secret on this repository.

How it's tested

• The workflow YAML parses. The job has contents: read and the steps above.
• The pinned host key equals ssh-keyscan -t ed25519 github.com today.
• The anchor check passes on w5's lockfile and flags a planted …/policy-engine-evil source. With the same GIT_CONFIG_* env, git ls-remote --get-url https://github.com/TinyCloudLabs/policy-engine resolves to ssh://git@github.com/TinyCloudLabs/policy-engine.
• The skip path runs on this PR (no secret): the job passes with the notice. The key path can only be exercised once the secret exists. Its cargo command is the one fix(TC-887): refresh the w5 lockfile and check separate workspace lockfiles in CI #332's lockfiles job runs for the other workspaces, and it passes locally for w5 with repository access.

[samgbafa]

APPROVE: see TC-887 (reviewed head effc805)

[samgbafa]

APPROVE: see TC-887 (reviewed head f8cfc3c)

[samgbafa]

Delta f8cfc3c..d47e956 verified: one file (tinycloud-node-server/tests/fixtures/email-claim-v1/rust/Cargo.toml) restored byte-for-byte to main 425a6d2's frozen bytes; the PR diff vs main is .github/workflows/rust.yml only, approved at f8cfc3c (6232664077). See TC-887.