feat: Make turbo prune Cargo-aware (#13281)
## Why
Final functional PR of the Cargo workspace series. `turbo prune <crate>`
must produce a **self-contained, buildable** Cargo workspace — kept
crates, a lockfile subset that passes `--locked`, and a root manifest
that Cargo will load. Like every PR in the series, the mechanism is a
trait surface: `Toolchain::prune_plan` (what the pruned repo needs
beyond the copied packages, as plain data) and `prune_finalize`
(post-write polish).
## What
- **Kept members from a `Cargo.lock` reachability walk**
(`cargo_prune_lock` in turborepo-lockfiles), not the package graph: the
lockfile merges dev-dependency edges, so members reachable only through
dev-deps — including cycle participants whose edges the graph drops —
are retained; kept crates' manifests reference their paths. The pruned
lock contains exactly the reachable closure
- **Root `Cargo.toml` rewritten with `toml_edit`** (comments/formatting
preserved): explicit `members`, filtered `default-members`,
`[workspace.dependencies]` path entries to removed crates dropped
- **`prune_finalize`**: reachability can't see Cargo's feature
unification, so `cargo metadata` runs in the output (offline → networked
fallback for git-patched workspaces on cold machines) letting Cargo
minimally sync its own lockfile; failure downgrades to a warning
- **Docker layout**: json layer = root manifest + kept crates'
`Cargo.toml`s + pruned lock; sources in the full layer.
`rust-toolchain*`/`.cargo/config*` carried over
- **Guards**: root-anchored packages (the synthetic `cargo` package) are
not pruneable targets; non-JS packages join turbo.json task pruning but
never the JS lockfile subgraph/keys or `package.json` workspaces
- **JS `prune_plan` is explicitly empty**, documented as known debt:
prune's JS machinery is its native path; folding it in means
restructuring a battle-tested command (same pattern as 7b/watch)
## How
Flag off: JS-only pruning is untouched (the plan loop no-ops; full suite
passes). Flag on, e2e-verified — the decisive test **builds the pruned
output with `cargo build --locked` and runs the binary**. Four new e2e
tests: buildable pruned workspace, docker layout, JS-only target emits
no Cargo files, workspace-package guard. Unit coverage: lock-walk
semantics (dev-reachable member retention, stale-root error), manifest
rewrite (member explicitness, default-members filtering, path-dep
dropping, comment preservation).
