fix(std,rust): preserve authorization across artifact path boundaries

[deciduously]

Rendered store paths and wrapper manifests retain artifact IDs but can discard the tokens and location needed to use them. Preserve authorized handles through library discovery, wrapper reconstruction, checkout, and the C and Rust proxies.

Use one shared resolver backed by tg::Template::unrender_with, seeded from typed values and the launching wrapper's checkout metadata. Restore manifest tokens with the existing Tokens::inherit API: retain existing tokens at each location and fill missing locations from the dependency or wrapper. Forward tokens unchanged for the server to validate. Authorization stays in dependency handles and is excluded from executable bytes.

Keep this PR as a draft until the Tangram prerequisites are merged. Both Rust workspaces pin b915f0a29 on integration/deciduously-open-prs-2026-09-09. The integration includes all six open Tangram PRs by deciduously as of September 9, 2026: #1112, #1114, #1116, #1117, #1119, and #1122, plus the client response-token fixes at 3d97ebe17. It uses the current inheritance APIs, with no local Cargo overrides.

Before marking ready:

• Merge feat(client): recover authorization from checkout xattrs tangram#1116 and feat(client): resolve artifact handles during unrender tangram#1117: checkout references and unrender resolution.
• Merge the client object response fixes at 3d97ebe17: refresh response tokens and preserve other locations.
• Merge fix(server): persist default token signing keys tangram#1119: persistent signing keys across server restarts.
• Merge fix(server): preserve authorization proofs for duplicate object children tangram#1112 and fix: return authorization for blob writes tangram#1122: repeated-child authorization and blob-write tokens.
• Replace the integration pins with a merged Tangram main revision and regenerate both Cargo lockfiles.
• Rerun the compiler proxy integration suites and VFS coverage with that client revision and a matching server.

Validation on aarch64 Linux against the published integration revision:

• Std Rust workspace: 15 tests passed. The existing tgld::tests::read_output_files fixture is excluded because this host lacks static libc.
• Rust proxy: 10 unit tests passed.
• Both Rust workspaces passed clippy with all features and targets and warnings denied; Rust formatting passed.
• The server-backed manifest round trip and unrender authorization tests passed.
• common/tests/wrapper_authorization.nu passed, including recovery in a fresh process after restarting the server with its default signing keys.
• The combined Tangram source passed bun run check and formatting. All eight focused CLI regressions passed with local backends, including checkout references, persisted keys, blob writes, repeated children, authorization diagnostics, and JavaScript token preservation.
• Package TypeScript checking, compiler builds, and VFS coverage have not been rerun for this revision.

Both Cargo lockfiles resolve the published commit with --locked. The repin changes only Tangram Git source revisions; existing registry dependency selections are unchanged.