Until now only the clippy CI job and the Dockerfile named a Rust version (kept in sync by hand), while every other CI job, the release binaries and the docs build ran on whatever `stable` happened to be that day. Rust 1.98.0 landing on 2026-08-20 broke `build-binaries` overnight because of that (#5935).
`rust-toolchain.toml` pins 1.96.0 with the `minimal` profile plus clippy, and every `rustup toolchain install stable ...` in CI becomes a bare `rustup toolchain install`, which reads the file. Starting at 1.96.0 (the version clippy is already clean against) keeps this change free of lint churn; catching up to 1.98.0 is a follow-up.
rustfmt stays on nightly because `.rustfmt.toml` uses nightly-only options, so that job now invokes `cargo +nightly fmt` explicitly instead of setting a rustup directory override, which would silently take precedence over the toolchain file.
The file does not list the linux cross-compilation targets on purpose: that would make every developer and CI job download `rust-std` they never use. The two consumers that cross-compile add the targets themselves.
Replaces the `cd frontend && npm ci` setup steps with a pnpm-flavoured
one: enable corepack (one-time), `pnpm install` from the repo root, then
`cd frontend && pnpm run <script>` for frontend scripts. misc/update.sh
also moves to `pnpm --filter mas-frontend run …`
Mention this specifically in contributing.md since CI also uses this test runner. My attempt to use `cargo test` failed due to PG connection pooling. In any case, unless there are reasons not to, we should keep close to mirroring what we do in CI.
Quentin Gliech