refactor: derive nightly toolchain from rust-toolchain.toml everywhere

Make rust-toolchain.toml the single source of truth for the pinned
nightly version. All local tooling now reads from it:

- justfile: parses channel from rust-toolchain.toml
- local-validate.sh: parses channel from rust-toolchain.toml
- Dockerfile: copies rust-toolchain.toml early and extracts channel
- e2e scripts: use plain `cargo` (rust-toolchain.toml auto-applies)
- CLAUDE.md, CONTRIBUTING.md, docs: reference rust-toolchain.toml

CI workflows still declare NIGHTLY_TOOLCHAIN as an env var (required
before checkout), annotated to keep in sync with rust-toolchain.toml.

Author: penso

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ permissions: {}
 
 env:
   CARGO_TERM_COLOR: always
+  # Must match rust-toolchain.toml (single source of truth for the nightly pin).
   NIGHTLY_TOOLCHAIN: nightly-2026-04-24
 
 jobs:

.github/workflows/release.yml

@@ -24,6 +24,7 @@ concurrency:
 permissions: {}
 
 env:
+  # Must match rust-toolchain.toml (single source of truth for the nightly pin).
   NIGHTLY_TOOLCHAIN: nightly-2026-04-24
   RELEASE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && 'true' || 'false' }}
   RELEASE_PRE_RELEASE: ${{ github.event_name == 'workflow_dispatch' && inputs.pre_release && 'true' || 'false' }}

CLAUDE.md

@@ -196,7 +196,7 @@ avoid `waitForTimeout()`.
 
 ## Code Quality
 
-- Never run `cargo fmt` on stable in this repo. Always use the pinned nightly rustfmt (`just format`, `just format-check`, or `cargo +nightly-2026-04-24 fmt ...`).
+- Never run `cargo fmt` on stable in this repo. Always use the pinned nightly rustfmt (`just format`, `just format-check`, or `cargo fmt` — `rust-toolchain.toml` selects the right nightly automatically).
 
 ```bash
 just format              # Format Rust (pinned nightly)
@@ -314,11 +314,11 @@ Conventional commits: `feat|fix|docs|style|refactor|test|chore(scope): descripti
 
 For incremental local edits before full validation:
 - TS/TSX changed: run `biome check --write` and `cd crates/web/ui && npm run build`.
-- Rust changed: run `cargo +nightly-2026-04-24 fmt --all -- --check`.
+- Rust changed: run `cargo fmt --all -- --check`.
 - Both changed: run all three.
 
 Exact commands (must match `local-validate.sh`):
-- Fmt: `cargo +nightly-2026-04-24 fmt --all -- --check`
+- Fmt: `cargo fmt --all -- --check`
 - Clippy: `just lint` (OS-aware: on macOS excludes CUDA features, on Linux uses `--all-features`)
 - Tests: `just test` (OS-aware: on macOS uses nextest without CUDA features, on Linux uses `--all-features`)
 - macOS app (Darwin hosts): `./scripts/build-swift-bridge.sh && ./scripts/generate-swift-project.sh && ./scripts/lint-swift.sh && xcodebuild -project apps/macos/Moltis.xcodeproj -scheme Moltis -configuration Release -destination "platform=macOS" -derivedDataPath apps/macos/.derivedData-local-validate CODE_SIGNING_ALLOWED=NO build`

CONTRIBUTING.md

@@ -17,7 +17,7 @@ For security issues, do not open a public issue. Follow `SECURITY.md` instead.
 Prerequisites:
 
 - Rust toolchain (stable)
-- `rustup` with nightly `nightly-2026-04-24` available
+- `rustup` with the nightly pinned in `rust-toolchain.toml` available
 - `just` task runner
 - `git-cliff` changelog generator
 - Node.js (for web UI e2e tests)

Dockerfile

@@ -15,8 +15,10 @@ FROM rust:bookworm AS builder
 
 WORKDIR /build
 
-# Switch to nightly (pinned for reproducibility; wacore-binary needs portable_simd)
-RUN rustup install nightly-2026-04-24 && rustup default nightly-2026-04-24
+# Copy rust-toolchain.toml first so the nightly pin is defined in one place.
+COPY rust-toolchain.toml ./
+RUN NIGHTLY="$(sed -nE 's/^channel[[:space:]]*=[[:space:]]*"([^"]+)"/\1/p' rust-toolchain.toml)" \
+    && rustup install "$NIGHTLY" && rustup default "$NIGHTLY"
 
 # Copy manifests first for better caching
 COPY Cargo.toml Cargo.lock ./

crates/web/ui/e2e/start-gateway-ollama-qwen-live.sh

@@ -169,7 +169,7 @@ OLLAMA_HOST="${OLLAMA_BIND}" OLLAMA_MODELS="${OLLAMA_MODELS_DIR}" ollama pull "$
 if [[ -n "${BINARY}" ]]; then
 	"${BINARY}" --no-tls --bind 127.0.0.1 --port "${PORT}" &
 else
-	cargo +nightly-2026-04-24 run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}" &
+	cargo run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}" &
 fi
 GATEWAY_PID="$!"
 wait "${GATEWAY_PID}"

crates/web/ui/e2e/start-gateway-onboarding-anthropic.sh

@@ -92,5 +92,5 @@ fi
 if [ -n "${BINARY}" ]; then
 	exec "${BINARY}" --no-tls --bind 127.0.0.1 --port "${PORT}"
 else
-	exec cargo +nightly-2026-04-24 run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
+	exec cargo run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
 fi

crates/web/ui/e2e/start-gateway-onboarding-auth.sh

@@ -66,5 +66,5 @@ fi
 if [ -n "${BINARY}" ]; then
 	exec "${BINARY}" --no-tls --bind 127.0.0.1 --port "${PORT}"
 else
-	exec cargo +nightly-2026-04-24 run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
+	exec cargo run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
 fi

crates/web/ui/e2e/start-gateway-onboarding.sh

@@ -62,5 +62,5 @@ fi
 if [ -n "${BINARY}" ]; then
 	exec "${BINARY}" --no-tls --bind 127.0.0.1 --port "${PORT}"
 else
-	exec cargo +nightly-2026-04-24 run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
+	exec cargo run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
 fi

crates/web/ui/e2e/start-gateway-openai-live.sh

@@ -113,5 +113,5 @@ fi
 if [ -n "${BINARY}" ]; then
 	exec "${BINARY}" --no-tls --bind 127.0.0.1 --port "${PORT}"
 else
-	exec cargo +nightly-2026-04-24 run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
+	exec cargo run --bin moltis -- --no-tls --bind 127.0.0.1 --port "${PORT}"
 fi