ci: separate Rust toolchain and cache ownership - #34

Summary

• replace the implicit Rust cache wrapper with explicit toolchain and Swatinem/rust-cache steps;
• bound Linux quality and cross-platform macro-runtime cache writers to successful main runs;
• use locked Cargo commands while preserving all existing quality and runtime gates.

Validation

• workflow YAML parsed successfully;
• git diff --check passed;
• cargo metadata --locked --no-deps --format-version 1 passed.

This is a repo-local implementation for wrightkit/.github#3. Remote CI still needs to confirm cache restore behavior.