CI: Contracts (Rust) fails on current stable (rust-lld undefined CosmWasm host imports) — pin the toolchain and commit Cargo.lock

[glandua]

Every CI run since June fails the Contracts (Rust) job at the wasm build step, independent of what the change touches. It failed on #108 in June under rustc 1.96.0, on #109 (three markdown files, no Rust) under rustc 1.98.1, and it now fails on main itself: the merge commits of #107 (2026-09-10) and #109 (2026-09-11) both ran red. main last passed on 2026-04-25.

error: linking with `rust-lld` failed: exit status: 1
rust-lld: error: …/libcosmwasm_std-….rlib(…): undefined symbol: db_read
rust-lld: error: … undefined symbol: addr_validate
rust-lld: error: … undefined symbol: secp256k1_verify
… (db_write, db_scan, db_next, db_remove, addr_humanize, addr_canonicalize,
   ed25519_verify, ed25519_batch_verify, secp256k1_recover_pubkey, query_chain, debug, abort)
error: could not compile `dynamic-supply` (lib) due to 1 previous error

The same list repeats for every contract in the workspace (attestation_bonding.wasm, fee_router.wasm, …). These are the CosmWasm host imports the runtime supplies; the linker now refuses them as undefined.

Cause, as far as the evidence goes. .github/workflows/ci.yml installs dtolnay/rust-toolchain@stable with no rust-toolchain.toml, and contracts/ has no committed Cargo.lock, so both the compiler and the dependency set float. The imports declared by cosmwasm-std = "2.2" link under the April 2026 stable and fail under 1.96 and later.

Run	Date	rustc	Contracts (Rust)
main @ 714b3f5	2026-04-25	stable of the day	pass
#108	2026-06-24	1.96.0	fail
#109 (docs only)	2026-09-10	1.98.1	fail
main after #107 and #109 merged	2026-09-10 / 11	current stable	fail

Proposed fix, in two steps so the repo goes green first

1. Pin. Add contracts/rust-toolchain.toml with the last known-good stable (April 2026; bisect from 1.95 if needed), make the workflow honor it instead of @stable, and commit contracts/Cargo.lock. Re-run main and governance: RFC-0001 — M013 fee split (28/25/45/2 → 15/30/50/5) #108 to confirm green.
2. Move forward. Bump cosmwasm-std / cosmwasm-schema / cw-storage-plus to releases that build on current stable (a version that declares the host imports with #[link(wasm_import_module = "env")], or whatever the CosmWasm changelog names for the 1.96+ linker behavior), then advance the pin.

Until step 1 lands, a red Contracts (Rust) check on a pull request is not evidence about that pull request. Open item affected today: #108.

Drafted with an agent; filed by a person.