ci: pin the toolchain so a rust release cannot redden a green main

[LeadcodeDev]

main is red, and no commit broke it. CI installed the floating stable channel, so each run tested whatever Rust had shipped by then. rustc moved 1.98.1 → 1.99.0 on 28 September, clippy sharpened redundant_field_names, and the schema work that had been green on its own branch failed the moment it merged. Two changes here: the lint, and the reason a Rust release could reach a green main at all.

The lint fires on the two #[from] variants of RustmotionError whose field is named source. thiserror's derive generates Self::JsonParse { source: source } for the From impl, and 1.99 attributes that to our field's span. The allow is on the module rather than on the variants: the generated impl From is a sibling item of the enum, not part of it, so a variant-level attribute leaves the error exactly where it was — measured, not assumed. Renaming the field was the other option and is worse, since source is what thiserror reads to implement Error::source and what the #[error("…{source}")] strings interpolate. The three tuple variants (Io(#[from] …)) expand to positional construction and never fired; FileRead has no #[from] and so has no generated impl.

rust-toolchain.toml is now the only place the version is written. rustup toolchain install with no argument reads it, components included, so no second copy can drift and CI cannot check a version the working tree does not. That replaces dtolnay/rust-toolchain in the four CI jobs and in publish: its toolchain input is required, defaults to stable, and does not read the manifest, so keeping it meant writing 1.99.0 five more times. Runners ship rustup, and the action leaving removes a third-party dependency from every job. Letting rustup auto-install from the manifest implicitly also works today and was rejected: rustup prints a deprecation for it and says it may stop working, which is the same delayed breakage this is meant to remove.

The audit job is deliberately left alone. It fails on a new advisory by design, and its ten --ignore entries carry a review date. Making it unconditionally green would mean not auditing.

Verification — cargo fmt --all --check, cargo clippy --workspace --all-targets --features rustmotion/studio -- -D warnings, and cargo test --workspace --features rustmotion/studio on 1.99.0: 2146 passed, 0 failed, 10 ignored across 52 suites. The clippy failure was reproduced locally on 1.99.0 before the fix, at the same two paths CI reported, and the variant-level allow was confirmed insufficient. Not verified: that the runner image's rustup honours the manifest, which only a CI run on this branch can show.

No issue exists for this; it came from the red run on main.