2.1.0 - self-contained Rust supply chain

Adds rust-lint, rust-release-binary, rust-sbom, rust-crates-publish
templates so a Rust CLI consumer can ship a fully-signed, cross-
compiled release through the dunn.dev catalog without depending on
any external catalog.

ci-rust image expanded: Rust 1.95 base, clippy + rustfmt rustup
components, standalone zig 0.13.0, cargo-zigbuild 0.22.2,
aarch64-apple-darwin and aarch64-unknown-linux-gnu rustup targets,
Phracker MacOSX 11.3 SDK mounted at /opt with SDKROOT exported.

Cross-compile picks zig-as-linker for darwin/arm64 + linux/arm64
(no nested docker required; one image, one toolchain). linux/amd64
is plain cargo build. parallel:matrix shape mirrors go-release-binary.

The supply-chain components (slsa-attest, release-create,
container-image) are language-agnostic and compose with
rust-release-binary the same as with go-release-binary.

See CHANGELOG.md for the full migration shape and consumer example.