build: bump the static-analysis toolchain to 1.97

[martinhavelka (wukchung)]

🤖

Impact

Unblocks every pull request in the repository, and the scheduled run against main. anvil-semver-check currently fails on all four pr-fast legs.

Problem

cargo-semver-checks builds rustdoc for the crate under test in a scratch project (cargo new + cargo add --path) that does not use the workspace Cargo.lock. It therefore re-resolves dependencies to their newest compatible versions.

kstring 2.0.3 and later require rustc 1.96. The workspace lock pins 2.0.2, so the normal build is fine, but the scratch rustdoc build takes 2.0.4 and fails against the pinned 1.95 toolchain:

error: rustc 1.95.0 is not supported by the following package:
  kstring@2.0.4 requires rustc 1.96.0

Nothing in the repository changed to cause this. It appeared when cargo-aprz-lib landed in #76 -- the first crate reaching kstring through rustsec -> gix -> gix-attributes -- and it broke as soon as kstring 2.0.3 was published.

Change

RUST_LATEST selects the static-analysis and mutation-testing toolchain. It is deliberately a separate knob from RUST_MSRV, which encodes the MSRV promise, but had drifted to the same value. Current stable is 1.97.

• rust-toolchain.toml and RUST_LATEST: 1.95 -> 1.97
• RUST_MSRV stays at 1.95, so the MSRV promise is unchanged

1.97 no longer reports single_use_lifetimes on group_all_metrics_by_category, leaving its #[expect] unfulfilled -- a warning, and therefore an error under the -D warnings policy. clippy.allow_attributes rules out swapping it for #[allow], so the now-dead attribute is removed.

Validation

Run from the repository root on Windows x86_64:

• cargo semver-checks --package cargo-aprz-lib --baseline-rev origin/main -- 223 checks: 223 pass, exit 0. Fails with exit 101 before this change.
• cargo clippy --workspace --all-targets --all-features -- clean, no warnings
• cargo fmt --all --check -- clean
• cargo anvil -- 87 items, all unchanged; no artifact churn from the bump

Reviewer notes

Pinning kstring was considered and rejected: it enters transitively, so constraining it would mean declaring an otherwise-unused direct dependency, which anvil-udeps would then flag. Upgrading cargo-semver-checks to 0.50.0 was also tested and does not help -- the scratch-project build is unchanged.

[martinhavelka (wukchung)]

🤖 Consolidated into #88, which now carries both the toolchain bump and the cargo-spellcheck bump. Closing this one; the branch is superseded, not abandoned.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.9%. Comparing base (f690340) to head (a662184).

❌ Your project status has failed because the head coverage (99.9%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff          @@
##            main     #89   +/-   ##
=====================================
  Coverage   99.9%   99.9%           
=====================================
  Files        135     135           
  Lines      17449   17449           
=====================================
  Hits       17448   17448           
  Misses         1       1           

Flag	Coverage Δ
linux	99.9% <ø> (ø)
linux-arm	99.9% <ø> (ø)
scheduled	?
windows	99.9% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.