Fix Windows CI and Rust toolchain pins

[onblueroses]

Summary

• run the security-sensitive Windows fixtures on an ephemeral NTFS volume restricted to the runner SID, with unconditional cleanup in CI and release verification
• route Windows product/store scratch data through that protected root and make the timestamp-preserving rewrite fixture mutate a completed, report-bearing record
• pin dtolnay/rust-toolchain to one persistent master-history SHA while declaring Rust 1.85.0 and 1.95.0 explicitly, so Dependabot cannot collapse the compiler contracts
• retain actionable stderr in product-test failures

Validation

• hosted CI: check, msrv, and windows all passed in run 29747131629
• cargo test --all-targets --locked
• cargo fmt --all -- --check
• both repository clippy gates with -D warnings
• shellcheck scripts/*.sh