ci: repin dtolnay/rust-toolchain to where v1 points now

[vyncint]

What & why

The action's v1 tag is a moving tag. On 2026-10-09 at 01:48 UTC it moved
from 7e38f4b4 to e2a55d2f when upstream merged dtolnay/rust-toolchain#187.
zizmor's online audits now fail every use: the # v1 comment no longer
names the pinned commit (ref-version-mismatch, medium), and the commit no
longer points at a tag (stale-action-refs). Main's last CI ran before the
move, on 2026-10-07; the first run after it, on #566, is red on zizmor
alone, and #566 touches no workflow.

The 16 pins in five workflows move to e2a55d2ffb04. The SHA was read from
gh api repos/dtolnay/rust-toolchain/commits/v1, and the tag object is the
commit itself. Between the two commits upstream changed one file,
action.yml (+29/−20), in two commits by dtolnay, both with valid
signatures. They pass toolchain, targets and components to the shell
through env: instead of interpolating them into run:, which is
input-injection hardening for upstream issue 179. There is no new input and
no network call.

Local zizmor --offline --persona=pedantic .github/ (1.29.0): no findings.
The online audits that caught this run only in CI.

Checklist

• Linked an issue (or explained above why none exists): none; this is a CI break from an upstream tag move, as in ci: repin dtolnay/rust-toolchain to where v1 points now #554
• Tests added/updated for the change: n/a, CI configuration only
• cargo fmt --all and cargo clippy --workspace --all-targets --all-features are clean (no Rust changed)
• All commits are signed off (git commit -s) — see CONTRIBUTING.md §5
• No AI attribution trailers (no AI co-authors, "Generated with" footers, or bot identities) — see CONTRIBUTING.md §6
• CHANGELOG.md updated under [Unreleased] (user-facing changes only): n/a, not user-facing
• Snapshot changes (if any) were reviewed with cargo insta review, not blind-accepted: none