CI floats on stable Rust, so a new clippy release turns main red with no commit

[macanderson]

Problem

.github/workflows/ci.yml uses dtolnay/rust-toolchain@stable for the fmt,
clippy, test and conformance jobs, and there is no rust-toolchain.toml in
the repository. The toolchain therefore moves under the tree on its own
schedule, and because clippy runs at -D warnings, every new warn-by-default
lint is an unannounced red main.

This is not hypothetical. Rust 1.98 added clippy::chunks_exact_to_as_chunks,
and it fires on contextgraph-types/src/attest.rs's from_hex — code that had
been green since #87 and that nobody had touched. PR #114 fixed that site
because its own CI could not go green otherwise, but the class of failure is
what matters: the next lint lands the same way, on whichever PR happens to be
open, and its author pays for it.

rustfmt has the same shape and is worse to diagnose, because a new stable
rustfmt silently reformats previously-clean files and the diff looks like the
author's.

Files

• .github/workflows/ci.yml — dtolnay/rust-toolchain@stable in fmt,
  clippy, test, and every conformance/SDK job
• Cargo.toml — [workspace.package] rust-version = "1.90" (the MSRV floor,
  which the msrv job already reads rather than hardcoding)
• (absent) rust-toolchain.toml

Proposed

Add a rust-toolchain.toml pinning a concrete version, and let the pinned
toolchain be what fmt/clippy/test use (rustup honours the file
automatically, so the workflow may not need to change at all). Bumping it then
becomes one deliberate PR that updates the pin and absorbs the new lints and any
cargo fmt --all churn in the same commit, instead of an ambush on whoever
opens the next pull request.

The msrv job keeps floating deliberately — its whole job is to prove the crate
still builds on the version it advertises, which is a different question.

Constraints

• The pin and rust-version are separate numbers with separate meanings; pinning
  the toolchain must not be read as raising the MSRV.
• A bump PR should run cargo fmt in the same change, so formatting drift never
  accumulates against a later, unrelated diff.

Done

rust-toolchain.toml names a concrete version, CI's lint and test jobs use it,
and a new stable release cannot redden main until someone bumps the pin on
purpose.