ci: pin Rust toolchain and make CI actually respect it

[Tobi-8]

Summary

Adds rust-toolchain.toml pinned to 1.96.0 so rustup installs the same toolchain locally and in CI regardless of when either runs, preventing silent wasm drift from toolchain version mismatches. Bumping the pin is now a deliberate, reviewable commit instead of happening silently whenever GitHub's stable runner image updates.

CI's own toolchain-install step also needed a fix: dtolnay/rust-toolchain's toolchain input is hard-required and has no fallback to read a rust-toolchain.toml file, so simply adding the pin file wasn't enough on its own, CI would have kept floating stable exactly as before. The install step now uses plain rustup commands instead, which auto-detect and install whatever the toolchain file pins, verified directly against the CI run log.

Both demo-consumer and asserter-consumer test snapshots are regenerated against the properly pinned toolchain.

Closes #38

Test plan

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test pass locally
• CONTRACT.md not applicable, no public interface change
• scripts/testnet-smoke.sh not applicable, no contract behavior change
• Verified CI's own run log shows 1.96.0 actually being installed, not stable

[collinsezedike]

rust-toolchain.toml is correct and helps local rustup invocations, but .github/workflows/ci.yml isn't updated, and CI doesn't actually respect it. The log for this PR's own run shows dtolnay/rust-toolchain@stable resolving toolchain: stable and running rustup toolchain install stable ..., completely ignoring the new pin. CI is still floating exactly as before, which is the actual source of every drift incident this cycle, so this doesn't achieve what the PR describes ("preventing silent wasm drift... regardless of when CI runs").

Fix: change the step to dtolnay/rust-toolchain@master and omit the toolchain input entirely; that action reads rust-toolchain.toml automatically when no explicit toolchain is given. Keep targets/components as a fallback or drop them since the file already specifies both.

[collinsezedike]

CI now genuinely installs the pinned 1.96.0, confirmed directly from the run log rather than just assumed. dtolnay/rust-toolchain's toolchain input turned out to be hard-required with no file-reading fallback, so the fix ended up being to drop that action entirely and rely on rustup's own auto-detection of rust-toolchain.toml (verified locally: rustup show picks 1.96.0 with zero explicit version anywhere in CI config). Also regenerated both demo-consumer and asserter-consumer snapshots against the properly pinned toolchain. fmt, clippy, build, and all 67 tests pass. Thanks for starting this one, take a look at the other open issues when you get a chance.