[R-5][Low] Operational maturity hardening

[v-code01]

From the review (https://github.com/v-code01/ledge/blob/main/AUDIT.md §F-9, R-5). Checklist:

• Pin the Rust toolchain (rust-toolchain.toml) so local == CI. (done: eba9d99 — single source of truth, CI reads the channel from the file)
• TLS/mTLS cert hot-rotation. (done: eacf0a0 — SIGHUP rebuilds + swaps the live listener TLS config from the same PEM paths, no restart; integration-tested served-cert flip)
• Backup/restore runbook beyond the S3 cold tier. (done: e47977d — deploy/backup/ cold+hot scripts + runbook, verified end-to-end by verify-roundtrip.sh, 3/0)
• Prometheus dashboards + alert rules. (done: 54970a3 — 15 promtool-validated alerts, Grafana dashboard, runnable stack, code-bound regression test)
• Automated cluster bootstrap. (done: 6c40cbd — [cluster].auto_bootstrap, lowest-id member self-initializes each shard; verified by a real 3-node self-form, no manual POST /cluster/init)
• unwrap/expect -> Result sweep of request paths. (done: 0d4aa74 — swept: server HTTP/RPC/cluster handlers already had ZERO prod unwraps; hardened the 2 invariant-dependent pack-decode unwraps + added E2E never-panic fuzzing of the full decoder)
• Registry-pushed / signed / multi-arch images. (done: v0.1.0 — .github/workflows/release.yml builds amd64+arm64 on native runners, cosign keyless-signs the multi-arch manifest + SBOM/provenance; published ghcr.io/v-code01/ledge:0.1.0/latest, Rekor tlog 20399055)
  Severity: Low (incremental).

[v-code01]

All R-5 operational-maturity items are now addressed (toolchain pin, Prometheus alerts + Grafana, unwrap→Result sweep, backup/restore runbook, automated cluster bootstrap, TLS hot-rotation, and signed multi-arch images shipped in v0.1.0). Closing is at the maintainer's discretion.