fix: validate Rust toolchain lock surface

[sylvesterkaczmarek]

Summary

Validate the Rust toolchain lock's declared host, target, and host-component surface instead of relying only on the artifact records and hard-coded installer arrays.

Problem

.cargo/tooling/rust-toolchain.lock.toml explicitly records three reviewed declarations under [rust]: hosts, targets, and host_components. script/vendor-rust generates those fields from the same authoritative arrays used by the installer.

On the base commit, script/validate-rust-toolchain never reads those declarations. It correctly requires the individual 24 artifact records and, online, compares those records with the upstream Rust channel manifest, but the lock's own advertised surface can disagree with the records that are actually validated.

That leaves a self-contradictory source-of-truth file: current code may behave safely because it ignores the declarations, while a reviewer or future consumer can reasonably interpret the recorded arrays as the lock's supported toolchain surface.

Evidence / reproduction

• script/lib/rust-dist.bash defines the reviewed RUST_DIST_HOSTS, RUST_DIST_TARGETS, and RUST_DIST_HOST_COMPONENTS arrays.
• rust_dist_write_lockfile serializes those arrays into [rust] as hosts, targets, and host_components.
• The committed Rust lock contains all three declarations.
• script/validate-rust-toolchain uses the shell arrays to require each host/component and target artifact, and requires 24 artifact records, but on the base commit it does not parse or compare the three declared arrays.
• Minimal reproduction: change only hosts = [...] in the committed lock to a shorter or reordered list while leaving all 24 artifact records, version, manifest URL, and checksums untouched. The base validator continues validating the artifact records and does not reject the contradictory declaration.
• The new self-test covers mismatched host, target, and component declarations independently.

Change

• parse the Rust lock with Python's standard-library TOML parser
• require its declared hosts, targets, and host_components arrays to exactly match the existing authoritative Rust distribution arrays
• pass those same arrays into the validator rather than duplicating platform values
• run a focused declaration self-test from the normal Rust lock validation path
• reuse the already-derived host/target CSV values for the online upstream-manifest comparison

No Rust version, artifact URL, checksum, supported platform, or installation behavior changes.