Apply the multi-stage minimal-runtime pattern to the Rust buildpack

MIR-1248 gave Go a multi-stage build: compile on the heavyweight builder, then ship just the binary on a minimal runtime base. Rust still ships its entire builder image as the final image (the pre-1248 Go behavior).

Give Rust the same treatment: glibc binaries → debian-slim, static musl-target builds → distroless/scratch. Roughly 8–25× smaller images, the same win Go just got. The runtime bases are already in the proxy allowlist (mirendev/infra#77) and the extract pattern exists in pkg/stackbuild, so this is mostly applying a known recipe rather than designing something new. Follow-up to MIR-1248.