feat(lanes): gate Rust through make, both hooks, CI and coverage

Section 4. Before this commit a Rust-only change was completely ungated — the
previous commit added a thousand lines of Rust and the hook printed "no
lint-relevant files staged", which is the defect this milestone exists to
remove.

make lint-rustd runs rustfmt and Clippy with warnings as errors;
make test-unit-rustd runs the cargo suite; both join lint-all and
test-unit-all rather than becoming a parallel set of claims. Each cd's into
rustd/ instead of passing --manifest-path, because rust-toolchain.toml
resolves from the working directory — running cargo from the repository root
would silently compile with whatever the shell has active instead of the pin.

check-version now covers BOTH places rustd/Cargo.toml spells the version: the
workspace package and the intra-workspace afd_core dependency. Seeding a drift
into either fails the lane naming which one.

Both hooks dispatch on *.rs and on rustd/* — manifests and the toolchain pin
change what the lane compiles and which compiler compiles it, so they trigger
it too.

The Continuous Integration (CI) job is deliberately absent from test.yml's
`test` aggregate needs list. That aggregate is the required context; joining it
would make the Rust job required by proxy, which is the failure PR #627
recorded. Invariant 5 holds.

The codecov floor is measured, not guessed: cargo llvm-cov reported 96.64%
lines on the first green suite, so rust-afd sits at 95%, the same way the Zig
flags sit just under theirs.

Adding the flag fired scripts/check_readme_badges.py — coverage uploaded under
a flag the README never shows. Fixed by adding the badge, not by touching the
check.

Eleven tests added for the error-code grammar, which the const asserts could
not reach: declaring a code runs the validator at compile time, so no reject
branch had ever executed. Coverage 77.31% to 96.64%.

Dimensions 4.1, 4.2 and 4.3 marked DONE.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>