fix(smoke): route multi-repo Cargo through the internal feed

[jamesadevine]

Failure summary

Final candidate orchestrator build 630157 failed only because multi-repo child 630166 failed. The other four children, including exact-tip ado-proxy child 630164, succeeded.

Expected: the trusted pre-agent step verifies both checkout paths and baked self identity, then the agent emits exactly one noop proof and stops.

Actual sequence in child 630166:

1. The trusted multi-repo assertion step passed.
2. The agent searched the repository and chose to run cargo test --test compiler_tests -- --nocapture.
3. Cargo attempted four CONNECT requests to index.crates.io:443; AWF denied all four with HTTP 403 / TCP_DENIED.
4. The agent emitted report-incomplete instead of the required noop, reporting CONNECT tunnel failed, response 403.
5. Agent and Detection jobs succeeded, but SafeOutputs rejected/executed the incomplete report as a failure, so the child and parent failed.
6. The agent made no repository changes.

Evidence:

• Parent: https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630157
• Child: https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630166
• Child source: tests/smoke/multi-repo.md, staged commit fb39b209a72a929a63efb77cbaa56ed0518e09c9
• Firewall timestamps: 2026-08-05T21:18:47.539Z, 21:18:48.473Z, 21:18:51.974Z, and 21:18:58.476Z; all CONNECT index.crates.io:443, status 403, decision TCP_DENIED.

What is and is not the fix

• Direct network.allowed: [rust] is NOT the fix because it permits public crates.io and bypasses the internal supply-chain boundary.
• The candidate orchestrator already writes .cargo/config.toml replacing crates.io with sparse+https://pkgs.dev.azure.com/msazuresphere/AgentPlayground/_packaging/cargo/Cargo/index/ and runs CargoAuthenticate@0, but that setup is local to the orchestrator checkout and does not reach the staged child worktree/agent.
• The multi-repo child must declare/configure Rust in front matter through an internal-feed-backed contract. Prefer a first-class structured Rust runtime/language declaration (for example runtimes.rust with internal feed configuration) if that is the intended authoring surface; ado-aw currently has no Rust runtime stanza, so the implementation must decide/add the safe contract rather than pretending one exists.
• A smoke-local trusted setup step is acceptable only if it writes source replacement to the self checkout and authenticates via CargoAuthenticate@0 without exposing a broadly scoped token.
• No public crates.io/index/static/rustup hosts may be added to AWF for this smoke.

Acceptance criteria

• Cargo resolves crates.io through the Azure Artifacts sparse mirror.
• Config/auth is available inside the AWF agent.
• Public crates hosts remain denied.
• cargo test can run.
• Exactly one noop.
• Child and parent green.
• A static assertion proves internal feed/source replacement and prevents public rust allowlist.