[MotherSphere]

What changed

dtolnay/rust-toolchain moves from 89b12181fb390509a0842a86cc55eeb8eb928c1d to 686976e191b89faba57d3206551f0f330d8cb249, the current head of its stable branch, in every place it is used:

• .github/workflows/ci.yml: 4 steps (lint, MSRV, release-profile build, dependency tree count)
• .github/workflows/release.yml: 1 step (release build matrix)

The new commit includes upstream PR dtolnay/rust-toolchain#187, "Safely handle action inputs": the toolchain, targets and components inputs now reach rustup through environment variables and bash arrays instead of being interpolated into the script text, and the parsed toolchain is written to $GITHUB_OUTPUT with a heredoc delimiter. Before this, an input value could inject shell commands into the step.

The release.yml change is a pin bump only and adopts nothing else from the templates.

Other pins

Every other action pin was checked against its latest release, and each pinned SHA matches the release tag:

Action	Release	SHA
actions/checkout	v7.0.1	3d3c42e5
Swatinem/rust-cache	v2.9.2	6323deb1
taiki-e/install-action	v2.87.26	f7e5d7c9
rustsec/audit-check	v2.0.0	69366f33
googleapis/release-please-action	v5.0.0	45996ed1
actions/upload-artifact	v7.0.2	cf430e03

No Dependabot github-actions group PR was open, so this PR does the bump itself.

Verification

• gh api repos/dtolnay/rust-toolchain/branches/stable returns 686976e1, and the compare against the old pin lists the #187 commits.
• The inputs Collector passes (components: clippy, rustfmt, toolchain: <msrv>, targets: <matrix target>) still split correctly under the new comma-and-whitespace parsing.
• Both workflow files parse as YAML. CI on this PR runs every job that uses the new pin, except the release build matrix, which only runs on a release tag.