Cargo Deny CI: rust 1.91.0-x86_64-unknown-linux-musl toolchain missing

[avrabe]

Pre-existing CI infra failure

`Cargo Deny` (`EmbarkStudios/cargo-deny-action@v2`) fails on every PR with:

```
error: override toolchain '1.91.0-x86_64-unknown-linux-musl' is not installed:
the toolchain file at '/github/workspace/rust-toolchain.toml' specifies an
uninstalled toolchain
```

The cargo-deny-action runs in a musl container that doesn't have the same Rust toolchain that `rust-toolchain.toml` pins. The container can't install the project's pinned toolchain so cargo-deny exits 1 before policy checks run.

Secondary signal: duplicate thiserror versions

Once the toolchain issue is resolved, the action also reports two duplicate-version warnings (likely the deeper issue cargo-deny is trying to flag):

• thiserror 1.0.69 + thiserror 2.0.17
• thiserror-impl 1.0.69 + thiserror-impl 2.0.17

Pinning a single major version should clean these up.

Resolution options

1. Switch to a version of cargo-deny-action that supports our pinned toolchain, OR pin the action to use a non-musl toolchain.
2. Run `cargo deny` directly in a regular Ubuntu runner where rust-toolchain.toml resolves cleanly.
3. Relax rust-toolchain.toml to allow >=1.91.0 so musl can satisfy it without exact-match.

Option (2) is the simplest workaround. (3) loses pin discipline.

Related

• Surfaced on PR release: v0.8.1 — audit-driven hardening #101.
• Pre-existing on main.
• Companion: RUSTSEC-2026-0097: rand 0.9.2 advisory in transitive deps (uuid, quinn-proto) #102 (Cargo Audit RUSTSEC-2026-0097).