ci: add Rust tests workflow (build + nextest + clippy)

[indyjonesnl]

Goal

The existing fmt.yml only checks formatting. Add a parallel Rust tests workflow that proves every PR (a) builds the workspace, (b) passes the test suite via cargo nextest, and (c) surfaces clippy findings. Catches regressions before merge.

Workflow design

• Triggers: push to main + every pull_request. The branches: [main] filter on push prevents duplicate runs when a feature-branch push also has an open PR (PR synchronize fires the same job).
• protoc installed via apt — api-server/build.rs needs it for the gnostic openapi proto.
• rhino cloned adjacent at ../rhino because crates/storage/Cargo.toml resolves the optional rhino dep via path = "../../../rhino". The default sqlite feature pulls it in, so it has to exist on disk for cargo metadata + build to work. The fmt.yml workflow needs the same treatment.
• cargo-nextest replaces cargo test (2-4× faster scheduling, better parallelism). Installed as a prebuilt binary via taiki-e/install-action.
• Swatinem/rust-cache@v2 instead of plain actions/cache — Rust-aware pruning + Cargo.lock + rustc hash for higher hit rates.
• Clippy runs without -D warnings while the baseline has ~30 pre-existing warnings (deprecated rand APIs after the 0.9 bump, unused-method warnings, const-is-empty etc.). Ratchet to deny mode once that backlog is cleaned up in a follow-up.
• fmt.yml updated to enumerate workspace members via cargo metadata --no-deps | jq rather than cargo fmt --all. --all recurses into rhino (a vendored sibling repo with its own rustfmt config) — we should only enforce style on our own crates.

Dependency

PR #32 ("bring test suite to green baseline") should land first so the very first run of the new workflow shows green. Without it, 9 pre-existing test failures + the daemonset assertion drift will keep this red.

Verification

Local on this branch (after merging #32):

cargo build --workspace --locked
cargo nextest run --workspace --locked --no-fail-fast
cargo clippy --workspace --all-targets --locked