feat(pipe): apply arbitrary TOML filter file via --toml

[schatt]

Summary

• Adds rtk pipe --toml <path> to compile a TOML filter file and apply it to stdin — without consulting the trust store or writing trust entries.
• -f <name> with --toml selects among filters in that file; a single-filter file needs no -f.
• Exposes compile_filters_from_path / compile_filters_from_str / select_compiled_filter for this preview path (hard-fail on compile errors so draft iteration isn't silent).
• Complements feat(pipe): accept built-in and trusted custom TOML filters in pipe -f #2999 (trusted/builtin TOML by name via -f); this covers untrusted draft files by path for filter-authoring / dashboard preview workflows.

Closes #3473

Trust model

• Explicit --toml PATH is an opt-in preview: the user pointed at the file.
• Does not load untrusted .rtk/filters.toml / global filters into the agent rewrite path.
• Does not mark the path trusted as a side effect.
• Still applies RAW_CAP, panic catch, and never_worse.

Test plan

• cargo fmt --all && cargo clippy --all-targets -- -D warnings && cargo test --all
• New tests/pipe_toml_test.rs: single filter, -f selection, multi-filter requires -f, missing file, no trust required
• Unit tests for hard-fail compile + filter selection
• Manual: printf 'a\nNOISE\nb\n' | rtk pipe --toml /tmp/draft.toml