chore(threads-bnu): mirror CI's 1.88.0 toolchain pin into the repo

[BunsDev]

Closes threads-bnu.

Problem

cargo clippy --workspace --all-targets -- -D warnings — a documented quality gate — returns different verdicts for different people on the same commit.

Locally on rustc 1.95.0 it fails:

error: manual implementation of `.is_multiple_of()`
  --> crates/coven-threads-core/src/staging.rs:127:8
   = note: `-D clippy::manual-is-multiple-of` implied by `-D warnings`

CI on the identical commit is green.

Root cause

The bead's original description blamed an unpinned CI runner. That is not the cause — Echo reproduced and corrected it. .github/workflows/ci.yml already pins dtolnay/rust-toolchain@1.88.0 explicitly and is not at the mercy of the runner image.

The real defect is narrower: the pin exists only inside the CI workflow. Nothing in the repository propagates it to a local toolchain, so anyone running the documented gate locally gets whatever rustc they happen to have.

Fix

Add rust-toolchain.toml at exactly 1.88.0. This mirrors an existing authoritative decision rather than changing one — it agrees with ci.yml and with rust-version = "1.88" in Cargo.toml. No verdict changes anywhere; local simply starts agreeing with CI.

The alternative (accept a newer toolchain, fix/allow the lint) is strictly larger: it requires editing ci.yml to move the pin, which changes the verdict surface for every existing commit, and contradicts rust-version unless that is bumped too.

staging.rs is not touched. Only the toolchain reading it changes.

Paired-pin hazard

A rust-toolchain.toml takes precedence for local cargo invocations. If it ever diverges from ci.yml, the repo silently carries two disagreeing pins — harder to spot than the current no-pin state. The file therefore carries a header comment naming the two as a pair that must change together.

Verification

Run locally with the pin in place, on top of 74569e5:

Check	Result
toolchain resolution	rustc 1.95.0 → 1.88.0 from the file's presence alone
cargo fmt --all -- --check	clean
cargo clippy --locked --workspace --all-targets -- -D warnings	clean — staging.rs:127 no longer errors
cargo test --locked --workspace	249 passed / 0 failed (214 + 17 + 4 + 14, 1 doctest ignored)

Scope

P2, blocks nothing. Does not preempt the four P1 Phase-5 remediation beads (threads-okc, threads-980, threads-dgg, threads-zav). It does raise the floor under them: an unreproducible local gate is exactly what forced Echo to record that she could not run the suite while verifying threads-uqx.9.

Diagnosis by Echo; implementation and verification by Kitty.

[Copilot]

Pull request overview

This PR makes local Rust tooling deterministic by mirroring CI’s existing Rust toolchain pin into the repository, ensuring cargo fmt/clippy/test produce consistent results across developers and CI for the same commit.

Changes:

• Add a root rust-toolchain.toml pinning Rust 1.88.0 and installing rustfmt + clippy.
• Document the “paired pin” requirement so the repo pin stays aligned with .github/workflows/ci.yml and Cargo.toml’s rust-version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.