fix(rust-ci): pass explicit toolchain: stable to SHA-pinned dtolnay action (#439)

## What

Add an explicit `toolchain: stable` input to all four
`dtolnay/rust-toolchain` steps in
`.github/workflows/rust-ci-reusable.yml` (the `check`, `test`, `audit`,
and `coverage` jobs).

## Why

The reusable bundle pins `dtolnay/rust-toolchain` by commit SHA
(`@67ef31d5…`). That action infers the toolchain from its `@`-ref (e.g.
`@stable` → `stable`), but a **SHA ref carries no version**, so the
action's internal "parse toolchain version" step receives an empty
`toolchain` and aborts:

```
'toolchain' is a required input
Process completed with exit code 1
```

This is the estate-wide **`rust-ci / Cargo check + clippy + fmt`** red
that appears on every PR across the ~28 repos consuming this reusable
workflow. Confirmed live against `iseriser` run `28287559313` (job
*Cargo check + clippy + fmt*), whose failed step logged the env line
`toolchain:` (empty) immediately before the error.

## Fix

Each step now passes `toolchain: stable`, matching the existing `#
stable` pin comment. The `check` job keeps its `components: clippy,
rustfmt`; the other three gain a `with:` block. No behavioural change
beyond making the toolchain explicit — which is exactly what the SHA pin
requires.

## Propagation

Single-source fix: consumers pin this reusable by SHA and inherit the
fix on the next standards-reusable pin refresh (the existing "refresh
standards reusable pins to current HEAD" flow). No consumer-side edits
are part of this PR.

## Verification

- `python3 -c "import yaml; yaml.safe_load(...)"` → YAML parses.
- All four `dtolnay/rust-toolchain` steps now carry `toolchain: stable`
(grep-confirmed).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx

---
_Generated by [Claude
Code](https://claude.ai/code/session_01A6PSzJWpRxtzGDjUCEh7Mx)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/rust-ci-reusable.yml

@@ -149,8 +149,14 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` is mandatory because the action is pinned by commit SHA:
+        # dtolnay/rust-toolchain infers the toolchain from the `@`-ref (e.g.
+        # `@stable`), but a SHA ref carries no version, so the action's "parse
+        # toolchain version" step fails with `'toolchain' is a required input`.
+        # See standards estate-wide rust-ci red.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
         with:
+          toolchain: stable
           components: clippy, rustfmt
 
       - name: Cache cargo registry and build
@@ -190,7 +196,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Cache cargo registry and build
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
@@ -230,7 +239,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Install cargo-audit
         # Use the binstall path when available to skip a from-source rebuild
@@ -260,7 +272,10 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
+        # `toolchain:` mandatory under SHA pin — see Cargo check job above.
         uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable
+        with:
+          toolchain: stable
 
       - name: Install tarpaulin
         run: cargo install cargo-tarpaulin --locked