fix(rust): bound validation workspace materialization

[tomdps]

Summary

• reuse one disposable materialized Rust workspace per validation file-view state and materialization environment instead of recursively copying the repo once per Rust check
• dispose run-scoped resources on pass, policy failure, fail-fast, streaming, and thrown-check paths; evict rejected factories and dispose successful resources once in reverse creation order
• preserve distinct staged/tree/overlay and environment semantics, including separate introduced before/after states
• add regression coverage proving multi-check workspace sharing, environment isolation, cleanup, rejected-factory recovery, and reverse-order disposal
• prepare and document the 0.2.1 hotfix release, including versioned package/native metadata and regenerated release/cutover receipts

Root cause

Each Rust materializing check independently copied the entire target repository into a new lattice-validation-rust-* tree and deleted it afterward. Multi-check and concurrent agent runs amplified that into a high-volume recursive filesystem event storm; interrupted runs could also leave large temporary trees behind, driving macOS fseventsd memory growth.

Verification

• npm run lint — passed
• tsc -b && node --test tests/validation-runner.test.mjs tests/validation-rust.test.mjs — 92/92 passed
• focused release-version regression set — 80/80 passed
• npm run pack:check — passed
• graph, release, and installed-package cutover receipts — regenerated and passed
• npm run ci — passed end-to-end at 2026-07-18T06:50:52Z (Rust 95; main Node 824 with 819 pass/5 skip; Python 114; native packaging 9; all release gates passed)

Active-agent safety

npm run ci:local was intentionally not run because its retained current-tool lane stops the shared Rox daemon; that would violate the requirement to preserve active Codex/Orca/Zeroshot work. The PR's isolated GitHub checks remain the merge gate.