actions/setup: consumer tool bootstrap (install component-test-cli/ct-runner at the Cargo.lock rev, cache, pins gate)

[lann]

Every consumer has hand-rolled the same bootstrap, and the four copies have diverged (part of the consumer-boilerplate review; umbrella on #14):

• webcrypto conformance/driver-ct/justfile _ct-tools: .rev stamp file, CONFORMANCE_CT_TOOLS local-override env, installs CLI and ct-runner.
• websocket conformance/driver-ct/justfile _ct-tools: re-runs cargo install every invocation (relies on the no-op), --js-lock pnpm-lock.yaml.
• webrtc-datachannels conformance/justfile _ct-tools: pins-based already-installed early exit, installs the CLI only (runner embedded as a library).
• tls conformance/driver-ct/justfile _ct-tools: stamp file, both tools, --cargo-lock only (no jco tree yet).

All four share the core: grep the rev+url out of Cargo.lock anchored on the component-test-sdk crate name (rename-proof), cargo install --locked --root target/ct-tools --git <url> --rev <rev>, then component-test pins --expect <rev> as the one-rev-everywhere gate.

Proposal. A composite actions/setup owning the CI half:

• Inputs: cargo-lock (default Cargo.lock), js-locks (multiline, optional), tools (default component-test-cli component-test-runner), install-root (default target/ct-tools), and a source-path override (install --path instead of --git, for testing the action from its own checkout and for local-override parity with webcrypto's env var).
• Steps: derive rev/url from the lock; actions/cache on the install root keyed (os, rev, hashFiles(rust-toolchain.toml)) — webcrypto's ci.yml already carries exactly this cache stanza per-repo; install on miss; run the pins gate with every provided lock.
• Output: rev (consumers reuse it — e.g. the aggregate ref guard, until # removes that need).

The local-dev half stays a justfile recipe, but converge the four variants to one canonical text documented in actions/README.md so the copies diff empty against each other (near-identical diffs review sublinearly; divergence is currently unreviewable).

Evidence that the per-run cargo install cost is already being worked around: webrtc's conformance workflow tarballs target/ct-tools/bin/component-test into a build artifact to avoid reinstalling in downstream jobs.