Problem

CI uses dtolnay/rust-toolchain@stable, which currently resolves to rust 1.96.0, while the repo had no toolchain pin. Local development was on 1.94.0, so cargo clippy --workspace --all-targets -- -D warnings passed locally but failed in CI — 1.96.0 flags lints (including pre-existing code like crates/kernel/src/mount_table.rs:716) that 1.94.0 did not. This drift makes CI unpredictable.

Fix

• Add rust-toolchain.toml at the repo root pinning channel = "1.96.0" with clippy + rustfmt components, so local and CI use the same toolchain and this can't silently drift again.
• Fix every clippy 1.96.0 lint surfaced under -D warnings:
  • unnecessary_sort_by → sort_by_key with std::cmp::Reverse: crates/kernel/src/mount_table.rs, crates/execution/src/wasm.rs, crates/sidecar/src/execution.rs (5 sites), crates/sidecar/src/filesystem.rs, crates/sidecar/src/plugins/host_dir.rs.
  • while_let_loop → while let loop in crates/sidecar/src/execution.rs.
  • useless_conversion (explicit .into_iter() in extend) in crates/sidecar/src/execution.rs.
  • manual_noop_waker → use std::task::Waker::noop(), removing the hand-rolled NoopWake impl in crates/sidecar/src/service.rs.

Verification (with 1.96.0)

• cargo clippy --workspace --all-targets -- -D warnings exits 0
• cargo fmt --all --check clean
• cargo build --workspace green