Rust download failure not caught during local builds

It looks like we're missing the `pipefail` setting on local builds, so if the `curl` download to install rustup fails, we never notice and just pipe an empty string into `sh` without realizing anything went wrong. Seen here: https://github.com/axodotdev/cargo-dist/actions/runs/16460730880/job/46527318893?pr=1940#step:5:1

```
if ! command -v cargo > /dev/null 2>&1; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs/ | sh -s -- -y
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
fi
curl: (7) Couldn't connect to server
```

Start by locating the local-build shell entry point that installs rustup, then reproduce the failed curl shown in GitHub Actions job step 5. Verify that a failed download causes the build to fail instead of continuing with an empty stream, and confirm the successful installation path still works.

Written by the indexing model from the issue text.