ci: silence cargo-deny toolchain-override stack trace (#81)

[StefanSteiner]

Closes #81 (Finding 1).

Problem

The cargo-deny CI job emits an alarming — but non-fatal — stack trace on every run:

error: override toolchain 'stable-x86_64-unknown-linux-musl' is not installed
Caused by:
    the toolchain file at '/github/workspace/rust-toolchain.toml' specifies an uninstalled toolchain
Stack backtrace:
   ...

The EmbarkStudios/cargo-deny-action@v2 image ships a pre-installed stable toolchain, but its rustup show step evaluates rust-toolchain.toml's override before that toolchain is registered. rustup show exits non-zero with the trace; the action doesn't propagate the code, then installs stable and runs cleanly. The job is green — the trace is just ~20 lines of noise per run.

Fix

Pin RUSTUP_TOOLCHAIN: stable as a job-level env on the deny job (Option 1 from the issue — the smallest patch). This bypasses the rust-toolchain.toml override probe inside the action's container, so the log stays clean.

Enforcement unchanged

cargo deny check --all-features --workspace still runs against the full workspace. Verified locally with RUSTUP_TOOLCHAIN=stable cargo deny check:

advisories ok, bans ok, licenses ok, sources ok

Scope

Finding 1 only. Finding 2 (the bitflags 1.x/2.x duplicate-version warn) is left as-is — it's upstream-blocked (plotters → core-graphics still pins bitflags 1.3.2) and the issue marks it optional. No license/advisory enforcement change.

🤖 Generated with Claude Code