feat(pipe): apply arbitrary TOML filter file to stdin (--toml)

Summary

rtk pipe -f <name> applies a named built-in (Rust) filter to stdin. Open PR #2999 extends -f to trusted/builtin TOML filters by name.

What's still missing for filter authoring / preview workflows: apply a draft TOML filter file to captured output without installing it into .rtk/filters.toml or trusting it into the agent path.

rtk pipe --toml /tmp/draft-filter.toml < captured-output.txt

Motivation

Local dashboard / filter workshop tools need to:

1. Capture (or re-run) a command's raw output
2. Draft a custom TOML filter from keep/strip marks
3. Preview what that filter would do to the same output via RTK's real pipeline
4. Iterate before writing + rtk trust

Today the engine can do this (parse_and_compile + apply_filter), but there is no CLI surface for an arbitrary path.

Proposal

• Add rtk pipe --toml <path> (mutually exclusive with -f / --passthrough as appropriate)
• Read + compile the TOML file explicitly named by the user (bypass trust store — this is preview, not agent injection)
• If the file defines multiple [filters.*], apply the first, or require --filter <name> to select
• Apply to stdin with existing RAW_CAP + never_worse behavior
• Do not write the path into the trust store as a side effect

Related: #2179, #2999

Out of scope

• Changing hook/rewrite trust gating
• Inline TOML via CLI string (file path only)

Start at the rtk pipe CLI entry point and trace the existing parse_and_compile and apply_filter engine paths. Add explicit TOML-file preview handling with the proposed -f/--passthrough constraints, selection behavior for multiple filters, existing RAW_CAP and never_worse behavior, and no trust-store write; related issues #2179 and #2999 provide context.