🔑 Accept optional GITHUB_TOKEN secret for cargo-binstall 🔑

- Dockerfile: the rust-tools stage's cargo binstall RUN now mounts an
  optional BuildKit secret (github_token -> GITHUB_TOKEN, required=false),
  matching the existing pattern in the sibling go image's Dockerfile. Raises
  the GitHub API rate limit from 60 to 5000 req/hr when a token is supplied.
- TODO.AI.md: logged the verified root cause and impact of this session's
  full multi-platform push build — GitHub API rate-limiting dropped 14/60
  tools on linux/amd64 and 40/60 tools on linux/arm64 during cargo binstall
  resolution, because two concurrent platform builds share one unauthenticated
  budget. Also logged that the shared build wrapper (/usr/local/bin/buildx,
  outside this repo) does not currently pass the secret flag, so this fix
  has no effect until the wrapper is updated or the secret is passed
  manually — flagged as a decision needed from the user. Separately logged
  that mingw-w64-gcc has no arm64 Alpine package (apk "no such package"),
  a platform limitation with no in-repo fix, affecting Windows GNU target
  linking on the arm64 image variant.

TODO.AI.md

@@ -0,0 +1,51 @@
+# TODO.AI.md
+
+## GitHub API rate-limiting drops most cross tools on arm64
+
+Verified 2026-08-21: a pushed multi-platform build (`docker.io/casjaysdev/rust:latest`,
+`linux/amd64,linux/arm64`) hit unauthenticated GitHub API rate-limiting (60 req/hr) during
+the `rust-tools` stage's `cargo binstall` tool loop, because both platforms build
+concurrently against the same shared, unauthenticated budget.
+
+Verified tool inventory in the pushed image:
+
+- `linux/amd64`: 14 of 60 tools missing (`cargo-edit`, `cargo-update`, `typos-cli`,
+  `taplo-cli`, `wasm-bindgen-cli`, `cargo-binutils`, `cargo-public-api`,
+  `cargo-spellcheck`, `cargo-dist`, `cargo-fuzz`, `flamegraph`, `probe-rs`, `sqlx-cli`,
+  `sea-orm-cli`)
+- `linux/arm64`: 40 of 60 tools missing (nearly the whole list, cascading from
+  `cargo-binstall` itself onward once the rate limit was exhausted)
+
+Fix applied in this session: `Dockerfile`'s `rust-tools` stage `cargo binstall` `RUN` now
+accepts an optional BuildKit secret (`--mount=type=secret,id=github_token,env=GITHUB_TOKEN,
+required=false`), matching the existing pattern already present in the sibling `go` image's
+Dockerfile. This raises the GitHub API rate limit from 60 to 5000 req/hr when a token is
+supplied.
+
+**Still open — outside this repo's scope:** the local build wrapper
+(`/usr/local/bin/buildx` → `/usr/local/share/CasjaysDev/scripts/bin/buildx`, a shared
+CasjaysDev script, not owned by this repo) does not pass `--secret id=github_token,
+env=GITHUB_TOKEN` on any `docker buildx build` invocation it generates — confirmed by
+grepping the saved build command in `/root/.config/myscripts/buildx/scripts/casjaysdev/
+rust-latest.sh`. Until that wrapper is updated (or the build is invoked manually with the
+secret flag), this Dockerfile fix has no effect and future pushed builds will keep hitting
+the same rate limit. This also affects the `go` image, which has carried the same
+secret-mount plumbing without the wrapper ever supplying it.
+
+Needs a decision from the user: fix the shared wrapper script (affects all dockersrc/
+casjaysdevdocker image builds, not just this repo), or accept manual
+`--secret id=github_token,env=GITHUB_TOKEN` invocation for now.
+
+## mingw-w64-gcc has no arm64 Alpine package
+
+Verified 2026-08-21 in the same build: `apk add --no-cache mingw-w64-gcc` succeeded on
+`linux/amd64` (installed `mingw-w64-gcc-15.2.0-r0`) but failed with `ERROR: unable to
+select packages: mingw-w64-gcc (no such package)` on `linux/arm64`. The install is wrapped
+in `|| true` in `rootfs/root/docker/setup/05-custom.sh`, so the build doesn't fail, but the
+`linux/arm64` variant of this image has the `x86_64-pc-windows-gnu` / `i686-pc-windows-gnu`
+rustup targets registered with no working `x86_64-w64-mingw32-gcc` / `i686-w64-mingw32-gcc`
+linker — `cargo build --target x86_64-pc-windows-gnu` will fail to link on that platform.
+This is an Alpine package-availability limitation (mingw-w64-gcc is not published for
+aarch64 in the Alpine repos as of this check), not a bug in this repo's scripts. No
+in-repo fix available; document as a known limitation if not already covered by README's
+existing Windows-MSVC/macOS-SDK caveats section.