fix(ci): restore wasm shadow-stack rustflags and scope server builds to phase-server

[matthewevans]

Two distinct causes broke the first executed deploy since #6238/#6282:

1. setup-rust-toolchain exports RUSTFLAGS='-D warnings' by default, and an
   env RUSTFLAGS overrides ALL .cargo/config.toml rustflags — silently
   dropping the [target.wasm32-unknown-unknown] 16 MiB shadow-stack
   link-arg feat(engine): drive & collapse accepted CR 732.2a infinite-loop shortcuts at the phase boundary #6238 added, tripping build-wasm.sh's assert_wasm_stack guard.
   Pass rustflags: '' on every wasm-building job (deploy build-wasm,
   release wasm + broker-wasm) so config.toml stays authoritative.

2. ship/native server pipeline #6282 gave phase-server a rustls-only reqwest, but the CI builds run
   'cargo build --bin phase-server' unscoped from the workspace root, so
   feature unification folds feed-scraper's native-tls reqwest features
   in, dragging openssl-sys into the musl cross-compile (no OpenSSL →
   build failure) and dynamic OpenSSL into the Docker image (runtime has
   no libssl). Scope every server build with -p phase-server: deploy,
   release (linux + matrix legs), Dockerfile compile stage, Tiltfile.

Verified: cargo tree -p phase-server -i openssl-sys --target
x86_64-unknown-linux-musl finds no path post-fix (present unscoped);
rustflags input semantics confirmed against the action's action.yml.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.