fix: stop forwarding host RUSTFLAGS into RISC-V cross-compilation

[sagar-a16z]

RUSTFLAGS and CARGO_ENCODED_RUSTFLAGS target the host compiler. Forwarding
them into riscv64imac cross-compilation leaks host-specific flags like
-C target-cpu=native and -C embed-bitcode=yes, which LLVM rejects with
"RV64 target requires an RV64 CPU".

Replace the RUSTFLAGS injection in build-syscall-cycles.sh with a new
--no-machine-outliner flag on BuildArgs. The machine outliner disable is
an internal correctness invariant of the cycle-counting tool, not a
user-configurable knob, so it belongs in the build interface rather than
the caller's environment.

Also add ZEROOS_GUEST_RUSTFLAGS as an explicit opt-in escape hatch for
callers that genuinely need to inject flags into the guest build. The
name makes the target unambiguous and prevents accidental host flag leakage.

[cursor]

PR Summary

Medium Risk
Changes how cargo spike build constructs guest CARGO_ENCODED_RUSTFLAGS, which could break workflows that relied on inherited RUSTFLAGS during cross-compilation. Risk is limited to build tooling but impacts all RISC-V guest builds and cycle-counting correctness.

Overview
Stops forwarding host RUSTFLAGS/CARGO_ENCODED_RUSTFLAGS into RISC-V guest builds by building a fresh CARGO_ENCODED_RUSTFLAGS set in zeroos-build, avoiding host-only LLVM flags that can break riscv64 compilation.

Adds --no-machine-outliner to cargo spike build to disable LLVM outlining when cycle attribution must be accurate, updates build-syscall-cycles.sh to use this flag instead of injecting RUSTFLAGS, and introduces ZEROOS_GUEST_RUSTFLAGS as an explicit opt-in way to add guest-only rustc flags.

^{Written by Cursor Bugbot for commit fd9b239. This will update automatically on new commits. Configure here.}