Isolate Rust Cloud client and worker credentials by subprocess role

[rmcdaniel]

Problem

The public Rust Cloud quickstart exports both role credentials before invoking scripts/rust-cloud.sh. The script then runs artifact resolution, Cargo dependency and build commands, the worker process, and dw without removing or scoping the inherited environment. As a result, the worker receives the client credential, client-side subprocesses receive the worker credential, and Cargo/build subprocesses receive both secrets even though the onboarding contract promises separate role-scoped credentials.

The current contract tests inspect source strings but do not verify child-process environments, so this boundary can regress while CI remains green.

Acceptance criteria

• Capture the supplied credentials and remove both token variables from the ambient environment before artifact resolution, dependency inspection, and compilation.
• Launch the Rust worker with only its required runtime URL, namespace, task queue, and worker credential; prove the client credential is absent from that process.
• Launch the CLI workflow command with only the client credential required for the operation; prove the worker credential is absent from that process.
• Apply the same isolation to both the one-terminal run path and the two-terminal worker path without weakening exact-version checks, completion output, failure propagation, or clean worker shutdown.
• Add behavior-level coverage with controlled child processes that asserts allowed and forbidden environment variables. Do not rely only on literal source assertions.
• Keep the public quickstart accurate if the environment setup or invocation changes.

Delete when

Delete this item when the published Rust Cloud Sample App path completes with separate client and worker credentials and executable evidence shows that resolver/build subprocesses receive neither token, the worker receives no client token, and the CLI receives no worker token.