[metalos][classic] Add RPM version pin and feature integrity checks

Summary:
# 💁 This diff

Adds two more checks to `metalos-rootfs-checker`, completing Phase 1:

**`rpm_version_pins.rs`** — Uses `Graph::pending_features()` to iterate features, deserializes RPM feature data into `rpm::Rpm` (the actual antlir2 type), identifies version-pinned subjects, and verifies each resolved to a matching RPM in the built image.

**`feature_integrity.rs`** — Uses `Graph::pending_features()` to iterate features, deserializes feature data into the actual antlir2 structs (`install::Install`, `ensure_dir_exists::EnsureDirExists`, `symlink::Symlink`), then verifies declared paths exist in the `DirEntry` facts. Detects missing paths, wrong symlink targets, and wrong file types (with debug output of what was actually found).

**Visibility:** Adds `//metalos/os/facebook/classic/flavor/...` to the default `lib_visibility` in `antlir/antlir2/features/defs.bzl` so all feature lib crates are accessible from the checker binary.

**Error handling:** If the depgraph can't be opened (e.g., format change or prebuilt layer), emits a warning finding and skips the check — does not block the diff.

Test Plan:
```
$ buck2 build fbcode//metalos/os/facebook/classic/flavor/check/rootfs_checker:metalos-rootfs-checker
BUILD SUCCEEDED
```

Ran against playground flavor — clean run, exit 0, no findings.

Reviewed By: vmagro

Differential Revision: D93607925

fbshipit-source-id: aee2c1328414942ed15a0d97319f19697ecff918

Author: vjt

antlir/antlir2/features/defs.bzl

@@ -76,6 +76,7 @@ def feature_impl(
         test_deps: list[str] | Select | None = []):
     lib_visibility = lib_visibility or visibility or [
         "//antlir/antlir2/...",
+        "//metalos/os/facebook/classic/flavor/...",
         "//tupperware/cm/antlir2/...",
     ]
     rust_library(