Harden cloud env setup script against the web setup-script contract

[jssblck]

Follow-up to #64. Hardens scripts/setup-claude-env.sh against the verified Claude Code on the web setup-script contract:

• Never blocks session start. A non-zero exit makes the session fail to start, so every step is now non-fatal and the script ends exit 0.
• Uses pre-installed runtimes. Rust/cargo and git are already in the base image, so the redundant apt-get install is gone (less to fail under restricted networking).
• Persists PATH via $CLAUDE_ENV_FILE when rustup installs to a fresh location.
• Stays within the ~5 minute environment-cache budget.

🤖 Generated with Claude Code

[attune-tuna]

Review finding:

• Likely bug — native build prerequisites were removed (scripts/setup-claude-env.sh:45-50)
  The new script assumes Rust/git are enough, but this workspace still has native build dependencies in Cargo.lock (ring, onig_sys, multiple tree-sitter-* crates via cc). On a fresh Ubuntu/Claude web image without a C compiler/toolchain, cargo build --all-targets will fail and the in-session build will fail for the same reason. I’d keep a best-effort root apt-get install --no-install-recommends build-essential pkg-config ca-certificates curl before cargo fetch/build, while still making it non-fatal to preserve the setup-script contract.

No other material issues found in the diff.