build: use in-tree proxy and Rust SDK

[AnthonyRonning]

Stacked on #853. This is 2 of 3 proxy-integration PRs; merge it after #853 and before the release-artifact layer.

This atomically switches desktop Maple and the proxy from crates.io to the imported Rust sources under proxy/ and sdk/rust, with version-plus-path constraints and narrowly regenerated lockfiles. It also moves proxy-only modules and dependencies behind the existing desktop cfg, so these crates disappear from iOS and Android rather than becoming accidental mobile inputs.

The same change updates app and component CI routing, proves the local dependency graph in CI, and changes the proxy Docker build to use a tightly allowlisted repository-root context so the in-tree SDK is available without sending the monorepo to Docker. The proxy package becomes 0.3.3, reserving the first in-tree release version after standalone 0.3.2.

Local validation:

• exactly one local opensecret and maple-proxy package in Maple cargo metadata
• neither package appears in iOS or Android cargo trees
• full Maple macOS Rust suite: 398 passed, 2 ignored; strict Clippy green
• proxy rustfmt, strict Clippy, docs, cargo-machete, and 27 tests
• both RustSec and denylist graphs
• root Nix flake checks, 11 classifier tests, actionlint, and pre-commit gates

The Docker daemon is unavailable on this VM, so the root-context AMD64 and ARM64 builds remain CI-only proof.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	48cbde8
Status:	✅  Deploy successful!
Preview URL:	https://9a77ceb7.maple-ca8.pages.dev
Branch Preview URL:	https://codex-proxy-local-rust.maple-ca8.pages.dev

View logs