fix(smoke): route multi-repo Cargo through the internal feed

## Failure summary

Final candidate orchestrator build 630157 failed only because multi-repo child 630166 failed. The other four children, including exact-tip ado-proxy child 630164, succeeded.

Expected: the trusted pre-agent step verifies both checkout paths and baked self identity, then the agent emits exactly one noop proof and stops.

Actual sequence in child 630166:
1. The trusted multi-repo assertion step passed.
2. The agent searched the repository and chose to run `cargo test --test compiler_tests -- --nocapture`.
3. Cargo attempted four CONNECT requests to `index.crates.io:443`; AWF denied all four with HTTP 403 / `TCP_DENIED`.
4. The agent emitted `report-incomplete` instead of the required noop, reporting `CONNECT tunnel failed, response 403`.
5. Agent and Detection jobs succeeded, but SafeOutputs rejected/executed the incomplete report as a failure, so the child and parent failed.
6. The agent made no repository changes.

Evidence:
- Parent: https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630157
- Child: https://dev.azure.com/msazuresphere/AgentPlayground/_build/results?buildId=630166
- Child source: `tests/smoke/multi-repo.md`, staged commit `fb39b209a72a929a63efb77cbaa56ed0518e09c9`
- Firewall timestamps: 2026-08-05T21:18:47.539Z, 21:18:48.473Z, 21:18:51.974Z, and 21:18:58.476Z; all `CONNECT index.crates.io:443`, status 403, decision `TCP_DENIED`.

## What is and is not the fix

- Direct `network.allowed: [rust]` is NOT the fix because it permits public crates.io and bypasses the internal supply-chain boundary.
- The candidate orchestrator already writes `.cargo/config.toml` replacing crates.io with `sparse+https://pkgs.dev.azure.com/msazuresphere/AgentPlayground/_packaging/cargo/Cargo/index/` and runs `CargoAuthenticate@0`, but that setup is local to the orchestrator checkout and does not reach the staged child worktree/agent.
- The multi-repo child must declare/configure Rust in front matter through an internal-feed-backed contract. Prefer a first-class structured Rust runtime/language declaration (for example `runtimes.rust` with internal feed configuration) if that is the intended authoring surface; ado-aw currently has no Rust runtime stanza, so the implementation must decide/add the safe contract rather than pretending one exists.
- A smoke-local trusted setup step is acceptable only if it writes source replacement to the self checkout and authenticates via `CargoAuthenticate@0` without exposing a broadly scoped token.
- No public crates.io/index/static/rustup hosts may be added to AWF for this smoke.

## Acceptance criteria

- Cargo resolves crates.io through the Azure Artifacts sparse mirror.
- Config/auth is available inside the AWF agent.
- Public crates hosts remain denied.
- `cargo test` can run.
- Exactly one noop.
- Child and parent green.
- A static assertion proves internal feed/source replacement and prevents public rust allowlist.

Start with tests/smoke/multi-repo.md and the candidate orchestrator's .cargo/config.toml and CargoAuthenticate@0 setup; trace how the staged child worktree reaches the AWF agent and inspect existing runtime front-matter contracts. Define the safe Rust/internal-feed contract, then run the multi-repo smoke and static assertions; done means Cargo uses the internal mirror, public hosts remain denied, exactly one noop is emitted, and parent and child are green.

Written by the indexing model from the issue text.