ci: pin the Rust toolchain to 1.95.0 instead of floating stable

CI ran dtolnay/rust-toolchain@stable (and rust-toolchain.toml pinned
channel = "stable"), so the runner tracked whatever stable was current —
which drifted ahead of the Nix-pinned dev toolchain (1.95.0, no rustup
to bump). Newer clippy lints then surfaced only on CI, after push.

Pin both to 1.95.0 so CI and local run the same clippy/rustfmt: set the
channel in rust-toolchain.toml and pass `toolchain: ${{ env.RUST_TOOLCHAIN }}`
(a new workflow-level env, kept in sync with the toml) to every
dtolnay/rust-toolchain step. Bumping the toolchain is now a deliberate
one-place change (both files + the dev environment) rather than implicit
drift on the runner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: UnbreakableMJ

.github/workflows/ci.yml

@@ -10,6 +10,10 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
+  # Pin the toolchain so CI matches local dev (no rustup here — the dev box is
+  # Nix-pinned at this version) and clippy/rustfmt can't drift ahead on the
+  # runner. Keep in sync with rust-toolchain.toml; bump both together.
+  RUST_TOOLCHAIN: "1.95.0"
 
 jobs:
   fmt:
@@ -19,6 +23,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
           components: rustfmt
       - run: cargo fmt --all -- --check
 
@@ -29,6 +34,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
           components: clippy
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --workspace --all-targets --all-features -- -D warnings
@@ -43,6 +49,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --workspace --all-targets
       - run: cargo test --workspace --all-targets
@@ -53,6 +61,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       # PRD G6: the server install path must keep building — the CLI behind
       # its `cli` feature gate, and the agent without the clipboard's
@@ -66,6 +76,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --bin vault --release
       - name: Verify attribution block
@@ -88,6 +100,8 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

rust-toolchain.toml

@@ -1,5 +1,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
+# Pinned (not "stable") so CI and local dev run the *same* clippy/rustfmt and
+# lints can't appear only on the runner. Keep this in sync with
+# RUST_TOOLCHAIN in .github/workflows/ci.yml; bump both together (and the dev
+# environment) in a dedicated change.
 [toolchain]
-channel = "stable"
+channel = "1.95.0"
 components = ["rustfmt", "clippy"]
 profile = "minimal"