fix(ci): make contract sentinels authoritative

[ohdearquant]

AI-assisted contribution: Codex prepared this change and PR description.

Summary

• run each Rust test/doctest sentinel phase under a fresh temporary HOME, while preserving the caller's Cargo and rustup homes
• retain the wrapped command's failure status, detect any default-store writes in the isolated home, and clean the temporary home on every exit path
• make the repository identifier-ban contract fail in CI when rg is unavailable, and explicitly provision/verify ripgrep on the Linux and macOS full-suite shard that runs it
• document the isolated-store contract for contributors

Validation

Validated commit 6afc39505b117d9e279dd1a3a2ade688f95d2c62 against main at c32ea3541063ca5626058dd52e9d5f419f7f2181:

• cargo test --manifest-path crates/Cargo.toml --workspace
• cargo check --manifest-path crates/Cargo.toml --workspace
• cargo clippy --manifest-path crates/Cargo.toml --workspace --all-targets -- -D warnings
• cargo fmt --manifest-path crates/Cargo.toml --all -- --check
• RUSTDOCFLAGS=-Dwarnings cargo doc --manifest-path crates/Cargo.toml --workspace --no-deps

Closes #1627
Closes #1636