Repin dtolnay/rust-toolchain after its stable branch was force-pushed

[dormouse-bot]

Every new PR's Workflow Lint job now fails, and main will fail it on its next push. This moves the dtolnay/rust-toolchain pin in ci.yml (2 places) and release.yml (1 place) from 89b12181 to 686976e1, the current tip of its stable branch.

Why. At 02:03Z today, upstream force-pushed stable to 686976e1. The old pin 89b12181 is no longer in that branch's history; GitHub's compare API reports the two as diverged, 1 ahead and 4 behind. zizmor's online impostor-commit audit flags any pinned commit that no branch or tag of the referenced repo contains, so it reports ci.yml:263, ci.yml:352, and release.yml:59 as errors. #1086 and #1087 failed on exactly those lines (e.g. run 37936709672), though neither PR touches a workflow file. main's last CI run, at 23:50Z yesterday, came before the force-push and passed.

Renovate tracks this pin through the # stable comment, but its github-actions group only runs on Mondays, so PRs would stay red until then. The same failure can return whenever upstream rewrites stable again; this PR does not change how the action is pinned.

Age of the new commit. 686976e1 is about 13 hours old. No configured cooldown covers action pins: docs/specs/security-supply-chain.md -> "Cooldown and alerts" gates npm, cargo, and the hand-installed zizmor and actionlint, and Renovate's github-actions rule sets no minimumReleaseAge. If you want the 1-day bar here anyway, it clears at 02:03Z on 10-10. The upstream change is dtolnay/rust-toolchain#187, "Safely handle action inputs": action.yml moves ${{ }} interpolations out of run: scripts into env: and builds rustup flags as a bash array. It also makes toolchain optional, defaulting to stable. None of that changes how our three call sites behave.

The Workflow Lint check on this PR verifies the fix.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	520602d
Status:	✅  Deploy successful!
Preview URL:	https://78e1c601.mouseterm.pages.dev
Branch Preview URL:	https://fix-rust-toolchain-pin.mouseterm.pages.dev

View logs

[nedtwigg]

Superseded by #1089, which drops dtolnay/rust-toolchain for direct rustup calls instead of re-pinning into a branch that upstream force-pushes on every change.