image(rust): pin rustup-init checksum via committed checksum files

[nozaq]

Reworked based on feedback: instead of storing a raw checksum value in build.yaml and re-deriving it via a dedicated update-checksums.yml workflow, commit the checksum file itself (rust/rustup-init-{amd64,arm64}.sha256), matching the existing pattern already used for every other image's signing key/keyring (bun/bun-signing-key.asc, mise/mise-minisign.pub, node/node-keyring.kbx, etc.). update-keys.yml already existed to keep exactly that kind of file in sync, so it's generalized (and renamed update-material.yml, since its job is no longer limited to signing keys) to support per-version URLs instead of introducing a second, near-duplicate workflow.

Summary

• rustup publishes no signature for rustup-init, so it had no independent trust anchor — the checksum file was previously fetched at build time from the same server as the binary.
• Commit rust/rustup-init-amd64.sha256 / rust/rustup-init-arm64.sha256 and bind-mount them into rust/Dockerfile's build for direct sha256sum -c verification, instead of downloading a same-channel checksum file at build time.
• Generalize update-keys.yml → update-material.yml: an entry can now set version_file/version_key to have VERSION substituted from a build.yaml before downloading, which is how the two new rustup-init entries track the currently pinned RUSTUP_VERSION. The workflow also now runs on rust/build.yaml changes (in addition to its own file and the weekly schedule) so a Renovate version bump gets a checksum-update PR promptly.
• Fixed hardcoded references to the old update-keys.yml name in release.yml and uv/Dockerfile comments, and added the new checksum files to build-checks.yml's trigger paths.

Test plan

• Verified rust/rustup-init-amd64.sha256 against the live rustup-init binary end-to-end (sha256sum -c reports OK)
• Validated the workflow's YAML and embedded shell syntax
• CI: build-checks.yml builds rust successfully with the committed checksum files on both architectures
• Post-merge: trigger workflow_dispatch on update-material.yml and confirm the rust entries are no-ops