feat: cover impl Into parameters and collected Vec returns

Summary

Nothing in the skills tells an agent when not to take impl Into<String>, and agents reach for it by habit. The repo's own benchmark has a case: in refactor-inventory-module (claude-without, grader 12 in benchmarks/cross-agent-2026-10/results.json), the agent changed add_item(&self, name: String, ..) to name: impl Into<String> in application code. That run didn't have the skill, but nothing in the skill would have stopped it either. The skills also say to hide iterator types behind impl Iterator, but never to return an iterator instead of collecting into a Vec.

• rust-best-practices section 1: application code takes String or &str rather than impl Into<String> parameters.
• rust-best-practices section 4: library code returns iterators, not a collected Vec, behind impl Iterator<Item = T> or a newtype.
• rust-review API design: flags impl Into<T> in application code or on a library function too rarely called to justify a copy per argument type, and flags a library function that collects into a Vec only to return it. Owned results stay fine when callers need ownership or random access, or when building the collection is the function's job.

rust-best-practices was already at 500 body lines, the check-skill.py threshold, so both edits extend existing bullets at the same line count. The reasoning and exceptions live in rust-review, which has room.

Why

Both rules come from the Google Rust Style Guide, and both were already in the Google digest under references/ without reaching either skill:

• Accepting Into: only where call-site ergonomics are paramount, weighed against code bloat; application code should almost never use it.
• Iterators vs. owned collections in return types

The Rust API Guidelines don't say otherwise on either point, so there was no conflict to resolve. No eval grader rewards impl Into parameters, so nothing in evals/ contradicts the new rules.

Testing

• python3 scripts/check-skill.py: 0 errors, 0 warnings; rust-best-practices body still 500 lines
• python3 scripts/check-examples.py: 0 errors, 23 blocks compiled, 10 skipped (no code blocks added)
• bash scripts/check-lints.sh: 28 expected lints fired

I didn't run the evals, since they're billed. If you'd like them run, or want an eval case that checks an agent leaves impl Into out of application code, I can add one.