ci: unblock task branch checks

[AlexMikhalev]

Summary

Fixes the local base-branch CI blockers shared by PR #953/#954:

• applies rustfmt to pre-existing terraphim_rlm formatting drift
• replaces Rust 1.91-only str::floor_char_boundary with MSRV-safe UTF-8 boundary logic for Rust 1.80
• hardens Firecracker VM create diagnostics and error handling
• installs cargo-nextest via the existing upstream installer pattern
• runs cargo nextest directly so filter expression quoting survives rch

Evidence

• cargo fmt -- --check
• cargo test -p terraphim_rlm query_loop::tests::test_truncate -- --nocapture
• cargo clippy -p terraphim_rlm -- -D warnings
• Firecracker workflow YAML parsed and Create VM shell path simulated
• independent reviews passed for the RLM MSRV fix and Firecracker workflow logic

Unblocks diagnosis/checks for PR #953 and PR #954; tracks Gitea #3173 for Firecracker/fcctl follow-through.

[AlexMikhalev]

CI unblocker status update

This PR carries the base-branch CI fixes needed before judging/rebasing PR #953/#954.

Current head: 2791ccd16cede02e46bcb4cfb13b32b9d1fe291d

Verified green on the prior run before the final timeout-only amendment:

• CI Native / setup: success
• CI Native / lint-and-format: success
• CI (Firecracker) / Rust build + test: success

Remaining external/workflow status from that run:

• CI (Firecracker) / Firecracker VM lifecycle proof: still failing at VM create with fcctl create status: 401; tracked as Gitea #3173 and assigned to Shimaguru/bigbox/fcctl ownership.
• Performance Benchmarking: service benchmark step completed, but Criterion was cancelled by the 30-minute job timeout. The final amendment raises the job timeout to 45 minutes. The PR-comment step also hit GitHub API 403 Resource not accessible by integration; it is already continue-on-error, and a broader token-permission patch was reviewed and rejected as unnecessary/overbroad.

Local/review verification behind this PR:

• cargo fmt -- --check
• cargo clippy -p terraphim_rlm -- -D warnings
• cargo test -p terraphim_rlm query_loop::tests::test_truncate -- --nocapture
• cargo test -p terraphim_server --test api_context_tests (19/19 passed)
• focused orchestrator cargo test and nextest run for test_handle_direct_dispatch_spawns_agent_without_mentions
• dedicated MCP autocomplete nextest run: 6 passed, 2 skipped
• YAML parse + git diff --check for workflow changes
• independent review passed for each final patch after superseding two earlier rejected approaches

[AlexMikhalev]

Final CI status for this unblocker

Current head: 2791ccd16cede02e46bcb4cfb13b32b9d1fe291d

Ownable/code/workflow gates are now green:

• CI Native / setup: success
• CI Native / lint-and-format: success
• CI (Firecracker) / Rust build + test: success
• Performance Benchmarking / Performance Benchmarks: success
• Performance Benchmarking / Performance Regression Check: success

The only remaining failing check is external infra/auth:

• CI (Firecracker) / Firecracker VM lifecycle proof: failure at VM create
• Latest evidence from run 31220278566: fcctl create status: 401
• Tracked as Gitea #3173: https://git.terraphim.cloud/terraphim/terraphim-ai/issues/3173

Notes:

• The 45-minute performance timeout amendment was sufficient: the benchmark run completed successfully after the previous 30-minute cap had cancelled it mid-Criterion.
• I did not keep the proposed pull-requests: write permission change; independent review rejected it as overbroad and likely unnecessary for the previous PR-comment 403. The rerun's PR-comment step succeeded with the existing issues: write permission.

Recommended next step: treat PR #955 as the base CI unblocker. Merge/rebase it before re-evaluating PR #953/#954. The remaining Firecracker lifecycle check needs the bigbox/fcctl-web auth fix from #3173.