new: surface cargo vendor failures and pin the vendoring toolchain

src/main.rs

@@ -287,11 +287,13 @@ fn main() {
             // resolves through the same pipeline; without a TTY the resolve
             // error lists every missing answer. Afterwards the two
             // verification builds are offered (`--no-verify` skips them;
-            // the structural self-checks inside `scaffold` always run).
+            // the structural self-checks inside `scaffold` always run), with
+            // the scaffold outcome (e.g. a failed vendoring) shaping the
+            // offer.
             if let Err(e) = rt.block_on(async {
                 let opts = pkh::new::questions::run(cli).await?;
-                pkh::new::scaffold(opts.clone(), &multi)?;
-                pkh::new::questions::offer_verification(&opts, &multi, no_verify).await;
+                let outcome = pkh::new::scaffold(opts.clone(), &multi)?;
+                pkh::new::questions::offer_verification(&opts, &outcome, &multi, no_verify).await;
                 Ok::<(), Box<dyn std::error::Error>>(())
             }) {
                 error!("{}", e);