Replace shared Rust homes with per-job isolation

[gunbai-bot]

Summary

• assign private CARGO_HOME and RUSTUP_HOME before setup-rust-toolchain in both required witness jobs and fleet-desired admission
• key each mutable home by github.run_id, github.run_attempt, and github.job, so concurrent jobs and reruns cannot share one dispatcher or toolchain store
• delete #9281s PATH-prepend and before/after dispatcher-snapshot mitigation in this same terminal replacement
• regenerate the committed workflow projections from their .dag authorities

Why this is the terminal construction

The shared mutable directory has produced at least two distinct filesystem events:

• job 98056007680 observed an in-place dispatcher rewrite: device, inode, and size stayed identical while mtime and ctime changed
• job 98043641840 resolved and successfully executed rustfmt at admission, then received ENOENT later, showing an unlink or replace event

Isolation removes the shared mutation boundary itself, covering both write patterns rather than fitting a retry or detector to either symptom.

Both homes are required. CARGO_HOME owns the dispatcher and registry; RUSTUP_HOME owns installed toolchains. Run ID alone is insufficient because build and floor execute concurrently in one workflow run, and run attempt is required because reruns reuse the run ID. No affected job currently has a matrix coordinate; any future matrix consumer must append its coordinate rather than sharing across matrix members.

Retention

These directories live under RUNNER_TEMP. GitHubs runner-variable contract states that this directory is emptied at the beginning and end of each job, except files the runner account cannot delete: https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables . Rustup and Cargo create these stores as the job principal, so their lifecycle is job-bounded rather than unbounded host accumulation.

Stack

This PR is based on #9281 only to make the replacement migration explicit: its first commit deletes that mitigation while adding isolation. #9281 remains incident evidence and should not land as a separate scaffold now that this terminal change exists.

Verification

• regenerated with current-tree gunbc via dag/tools/generated_artifact_gate.dag main_wet
• confirmed all three affected jobs emit distinct run/attempt/job paths for both homes
• confirmed no Suppress repeated shared-dispatcher installs in required jobs #9281 PATH-prepend, stat snapshot, or rewrite comparison survives
• git diff --check
• pre-push cargo fmt --all --check

[gunbai-bot]

Closing in favor of #9275, which establishes the stronger single shared isolation authority and already has capability/refusal coverage. Before #9275 is terminal, its shared toolchain_home_isolation_step and rustup pin must also be consumed by fleet_desired_admission_workflow; that setup-rust-toolchain invocation otherwise remains a shared-home writer. The run/attempt/job suffix used here is redundant because GitHub allocates and clears RUNNER_TEMP per job, but the fleet-desired population difference is load-bearing. — sent from calm-bee-813