zlayer-toolchain — reusable runtime toolchain provisioning.

This is a leaf crate: it depends only on other leaf crates (zlayer-paths, zlayer-registry, zlayer-types) and external crates. It depends on neither zlayer-agent nor zlayer-builder. It exists to break the zlayer-builder -> zlayer-agent build cycle: the macOS sandboxes (Seatbelt / HCS) have no package manager, so this crate is "our apt-get" — it provisions a named tool into a self-contained, absolute-prefix keg and returns a [ToolchainHandle] describing how to run it.

Provisioning strategy (macOS)

A keg is produced one of two ways, both relocation-free (no @@HOMEBREW@@):

• Source build ([source_build]): fetch the Homebrew formula's urls.stable.url source tarball and build it at an absolute keg prefix with the host Command Line Tools (the homebrew-core C-tool population: git, jq, cmake, ...).
• Prebuilt fetch ([prebuilt]): land a self-contained vendor archive for the language toolchains (go/node/rust/...).

Every keg carries a [manifest::KegManifest] (toolchain.json) describing its path_dirs + env, so the resolver is generic — no tool is special- cased on the handle path.

Surface

• [ensure_toolchain] — provision a named tool and return a [ToolchainHandle].
• [probe_ready_toolchain] — non-blocking, filesystem-only .ready probe that reconstructs a handle from an already-provisioned keg.

The old Homebrew bottle resolver/installer (download a prebuilt bottle and rewrite its @@HOMEBREW@@ install-name placeholders) has been removed entirely — see the module docs on [source_build] for why that path was a dead end under Seatbelt.