[codex] Add mise and shared Rust toolchain setup

[anp]

Summary

This makes mise the canonical project setup entrypoint for local development and CI. The PR adds .mise/config.toml with the Rust toolchains, Rust components, wasm target, Node version, and project CLI tools that the current build/test/demo workflows rely on.

It also updates CI to use that mise configuration through a shared setup action. The action keeps the unavoidable host package list intentionally small, installs mise-managed tools once per job, and configures rustup state so mise's cached Rust installs include requested components like clippy, rustfmt, llvm-tools-preview, and wasm32-unknown-unknown.

Finally, the workflow now has a terminal blocking CI job. That job always runs after the real CI jobs and fails if any required job fails, is cancelled, or is skipped, giving branch protection a single stable check name to require.

Intent

The goal is to make project setup reproducible without spreading toolchain pins and installer details across docs, CI jobs, and ad hoc local commands. Developers should be able to run mise install and get the same Rust/Node/tooling baseline that CI uses.

For CI specifically, the intent is to keep the workflow easy to delete or simplify later. The shared setup action centralizes today's non-Bazel setup, keeps system dependencies explicit and minimal, and leaves the individual jobs focused on the work they actually perform.

Notes

• Rust is pinned in .mise/config.toml instead of rust-toolchain.toml.
• The active Rust toolchain remains nightly-2021-10-30; this PR is about restoring the old toolchain under mise, not uprevving it.
• cargo-watch, wasm-bindgen-cli, Cypress, and Netlify CLI are installed through mise because existing commands and CI jobs already depend on them.
• Linux still installs libssl-dev as a host dependency because the old toolchain/tooling stack needs OpenSSL headers during setup.