chore(deps): bump Rust to 1.94 and wasmtime to 46.0.2 (RUSTSEC-2026-0222)

.github/workflows/runtime-exec-e2e.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Set up Rust (pinned by rust-toolchain.toml)
         uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: "1.93"
+          toolchain: "1.94"
 
       - name: Cache cargo
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

.github/workflows/sdlc-lint.yml

@@ -71,7 +71,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           # rust-toolchain.toml at repo root pins channel + clippy component
-          toolchain: "1.93"
+          toolchain: "1.94"
           components: clippy, rustfmt
 
       # Formatting ran BEFORE clippy: it needs no protoc and no build, so a

rust-toolchain.toml

@@ -1,6 +1,6 @@
 # Pin the Rust toolchain for reproducible builds across dev, CI, and the
-# Docker images (services/*/Dockerfile use rust:1.93-slim). The codebase uses
+# Docker images (services/*/Dockerfile use rust:1.94-slim). The codebase uses
 # edition 2024, which requires Rust >= 1.85.
 [toolchain]
-channel = "1.93"
+channel = "1.94"
 components = ["rustfmt", "clippy"]

services/gateway/Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.93-slim AS builder
+FROM rust:1.94-slim AS builder
 # openssl-sys needs the system OpenSSL headers + pkg-config to compile.
 RUN apt-get update && apt-get install -y --no-install-recommends pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
 WORKDIR /app

services/harness/src/exec.rs

@@ -586,6 +586,12 @@ pub async fn run(vm_id: String, manager: ManagerClient) -> Result<()> {
         .add_service(
             pb::runtime_harness_server::RuntimeHarnessServer::with_interceptor(
                 svc,
+                // clippy::result_large_err (tightened in Rust 1.94) flags the
+                // 176-byte `tonic::Status` here. Both halves of that signature
+                // are tonic's, not ours: `Interceptor` requires exactly
+                // `FnMut(Request<()>) -> Result<Request<()>, Status>`, so the
+                // error cannot be boxed without failing to implement the trait.
+                #[allow(clippy::result_large_err)]
                 move |req: tonic::Request<()>| check_bearer_token(req, &token_for_interceptor),
             ),
         )

services/model-router/Dockerfile

@@ -1,4 +1,4 @@
-FROM rust:1.93-slim AS builder
+FROM rust:1.94-slim AS builder
 # openssl-sys needs the system OpenSSL headers + pkg-config to compile.
 RUN apt-get update && apt-get install -y --no-install-recommends pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
 WORKDIR /app