Make Rust corpus evidence a scheduled canary

[zmaril]

Summary

• commit the first exact corpus lock: 1,000 pinned Rust crates, 27,307 admitted source files, and 126.6 MB of SHA-256-identified archives
• establish the independently hydrated sweep baseline: 27,292 pass, 2 grammar gaps, 13 oracle-confirmed noise files
• correct the Rust ledger from its unexplained 2,500-package / 61,801-file claim and label older shape and mutation measurements as historical
• add a weekly and manually dispatchable workflow that caches verified archives, hydrates the lock, sweeps from scratch, and fails on any ledger difference
• upload the full report even when the canary fails

Measured verification

• fetched all 1,000 pinned archives into a new empty corpus
• hydrated the committed lock into a second empty corpus with an empty cache
• confirmed fetched, locked, and hydrated manifests are byte-identical
• swept all 27,307 hydrated files twice; the generated ledger is idempotent
• cargo test --workspace
• actionlint .github/workflows/corpus-canary.yml

Closes #144