Function ensure_toolchain 

pub async fn ensure_toolchain(
    pkg: &str,
    platform: ToolPlatform,
    cache_dir: &Path,
    lockfile: Option<&ToolchainLockfile>,
) -> Result<ToolchainHandle>

Ensure a runtime tool is provisioned and return a handle describing how to run it.

The install is idempotent: the keg lives at {cache_dir}/{formula}-{version}-{arch} and is guarded by a .ready marker (written after the manifest::KegManifest), so a populated cache short-circuits without any network or build work.

Errors

Returns ToolchainError::NotImplemented for a Windows formula with no portable artifact (the caller routes those to the HCS choco-capture path). Propagates formula-resolution, download, dependency and build errors. When lockfile is Some, a lock hit for (pkg, platform, arch) pins the exact version + URL and the download is verified against the pinned sha256 (“consume-only”: this crate never writes the lock — the CLI does). A lock miss live-resolves and records the resolved digest in the keg manifest.