fix: harden proxy and establish Rust baseline

[nicholas-ruest]

What changed

• remove the unused claude-flow runtime dependency and regenerate the lockfile
• validate correlation IDs; cap upstream duration and streamed response bytes
• return bounded envelopes for malformed/non-JSON upstream responses without leaking bodies
• make the existing Rust workspace rustfmt-clean (125 files; mechanical formatting only)
• correct the declared/container/CI Rust minimum to 1.88.0, required by locked home@0.5.12
• add pinned Linux Node/Rust CI and public-safe MetaHarness evidence

Frozen evaluation

Base: a07a604dc14a3eeb2b9a07e85e9c41212156de9a

• Node 20.19.5: 9/9 baseline -> 14/14 candidate
• production audit: 36 findings (2 critical, 25 high) -> 0
• production graph: 416 packages -> no direct runtime dependencies
• fixed boundary contract: 1/6 -> 6/6
• rustfmt 1.88.0: 125-file baseline diff -> clean candidate
• Flywheel: 0.1667 -> 1.0000, no regression; signed replay passed
• Darwin real sandbox: baseline 0.985; two children 0.985; no harness mutation promoted
• MetaHarness pin: ruvnet/metaharness@e0dfd44da72b7adfb7c57fdd42d124be58ed7086
• packages: metaharness@0.4.17, @metaharness/darwin@0.10.3, @metaharness/flywheel@0.1.12

Validation state

• exact-head CI: Node tests/audit and Rust rustfmt pass
• strict workspace clippy fails; a local replay reached at least 29 -D warnings errors before compilation stopped, including legacy public-constructor complexity and test unwrap/expect policy debt
• exact published tree full Rust suite: default parallel run exposed a Phase 7 environment-variable race (40 passed, 1 failed in gateway-agents)
• serial replay: cargo +1.88.0 test --workspace --all-features --locked -- --test-threads=1 exited 0
• merge remains blocked; no lint suppression or gate weakening has been applied

The first CI run correctly rejected Node 20 timeout-test liveness and the unformatted Rust baseline. Those issues are fixed. A bulk clippy auto-fix experiment touching 45 files was rejected and not published because it remained non-green and exceeded this bounded change.

Rollback

Revert the squash/merge commit for this PR to restore the prior lockfile, proxy behavior, Rust formatting, and toolchain declarations atomically.