Pin toolchain to a fixed channel and add an enforced lint gate

.github/workflows/crates.yml

@@ -160,11 +160,13 @@ jobs:
       with:
         save-if: ${{ github.ref == 'refs/heads/main' }}
 
+    # Advisory only (no -D warnings) — the enforced gate lives in lint.yml.
     - run: rustup component add clippy && cargo clippy --all-targets
     - name: clippy (bench-suite feature)
       run: cargo clippy -p tract-cli --features bench-suite
     - name: test (bench-suite feature)
       run: cargo test -p tract-cli --features bench-suite --bin tract bench_
+    # Enforced fmt check also runs in lint.yml; kept here too for this job's own gating.
     - name: fmt
       run: rustup component add rustfmt --toolchain stable && cargo +stable fmt --check
     - name: Warnings

.github/workflows/lint.yml

@@ -0,0 +1,43 @@
+name: lint
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          # No `toolchain:` input — the action reads `rust-toolchain.toml`, so the
+          # pinned version lives in exactly ONE place.
+          components: rustfmt, clippy
+
+      - run: cargo fmt --all --check
+
+  clippy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          # No `toolchain:` input — the action reads `rust-toolchain.toml`, so the
+          # pinned version lives in exactly ONE place.
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - run: cargo clippy --all-targets -- -D warnings

rust-toolchain.toml

@@ -1,3 +1,7 @@
+# Bump log (append-only):
+# - 2026-09-05: pinned to a fixed channel (was floating "stable"), joining
+#   the workspace-wide Rust toolchain sweep. A future bump edits only the
+#   `channel` line below — the version lives in exactly one place.
 [toolchain]
-channel = "stable"
+channel = "1.98.1"
 components = ["rustfmt", "clippy"]