ci(rust): standardize checks and profiles#92

Stacked on #90. Review this PR against codex/nfdump-binary.

Problem

The Rust pipeline checks were serialized inside the web job and shared one broad toolchain cache. That coupled unrelated failures, prevented the two surfaces from running in parallel, and left production/profiling Cargo profiles implicit.

Solution

• split web and Rust validation into independent, clearly named CI jobs with separate caches
• run the standard Rust format, Clippy, check, and test commands against the pinned toolchain and locked dependencies
• grant the workflow read-only repository contents permission
• let Playwright depend only on the web checks it actually requires
• enable thin LTO with one codegen unit for release binaries and add a release-equivalent profiling profile with line tables

Reviewer fast path

No local dataset or compiled nfdump binary is required.

1. Open the Actions run and confirm Web Checks and Rust Pipeline Checks run independently.
2. Confirm Playwright E2E starts after Web Checks.
3. Locally, cargo build --profile profiling --locked should produce an optimized binary with line information.

Expected result: existing web and pipeline validation remain intact, failures are attributed to the correct surface, and release/profiling builds use the workspace profiles.

Decisions and edge cases

• The exact Rust version still comes from rust-toolchain.toml; CI does not introduce a second version source.
• Cargo commands retain --locked, and lint/test coverage retains all targets or all features as appropriate.
• The release profile does not strip symbols or change panic behavior, preserving diagnostics and failure semantics.
• Playwright is not blocked by an unrelated Rust failure, but all three jobs remain required parts of the workflow.

Verification

• bun run format
• bun run lint
• bun run typecheck
• bun run test:db (86 unit tests, 4 compare-CLI integration tests)
• cargo metadata --format-version 1 --locked --no-deps
• git diff --check
• GitHub Actions: Web Checks, Rust Pipeline Checks, and Playwright E2E passed

Remaining manual verification: none.

Built and verified with Codex (GPT-5.6 Sol) in T3 Code through the Codex agent harness.