fix(rust): isolate cache inputs across worktrees

[jleni]

Fixes #760.

What changed

• Bind every rustc source's stable path identity together with its content hash (cache-key schema v26), so swapping equal content between paths cannot collide.
• Store Rust dep-info with portable source-root sentinels and expand it for the consuming worktree. Publication now fails closed if dep-info cannot be made portable.
• Make kache cargo build/check isolate Cargo fingerprints in a workspace-local build directory while retaining the configured shared artifact target (Cargo 1.91+).
• Cover configured roots, symlink/canonical aliases, Unicode/non-UTF-8 paths, Windows drive/UNC/verbatim paths, and source-root precedence.

Root cause

The reported n00n history did not have byte-identical Rust sources: the relevant change added both a literal builtin entry and an include_dir! invocation. In the exact shared-target reproduction, Cargo marked the old unit Fresh, so it never invoked RUSTC_WRAPPER; Kache could not validate or reject it.

The investigation also found two independent Kache correctness holes:

• source keys folded a sorted multiset of content hashes without source-path association;
• cached .d files could retain a live donor-worktree path, allowing Cargo to validate the wrong tree after a relocated hit.

The new kache cargo isolation closes the pre-wrapper Cargo fingerprint boundary, while the key and dep-info changes close the Kache-owned boundaries. Arbitrary undeclared std::fs reads inside proc macros remain outside rustc's observable inputs and still require declared extra_inputs.

Validation

• cargo fmt --all -- --check
• cargo check --tests
• just lint
• cargo test --workspace --test '*' (all integration tests green)
• focused cache-key, Cargo proxy, path-normalizer, dep-info, and relocated-worktree tests green
• full unit run: 1,985/1,988 green; the three unrelated process-inspection tests fail under the shared macOS runner and pass individually