[MotherSphere]

What changed

The repository's own workflows pinned dtolnay/rust-toolchain at 4cda84d5, an old head of the action's stable branch. That commit predates upstream dtolnay/rust-toolchain#187, "Safely handle action inputs", which passes toolchain, targets and components to rustup through environment variables and bash arrays instead of interpolating them into the script.

All three uses now pin e2a55d2f, the merge commit of #187 and the current head of master, the same pin templates/sign-and-publish-caller.yml already uses:

• .github/workflows/ci.yml: the tokens job and the MSRV job
• .github/workflows/dependencies.yml: the currency job

A master pin has no default toolchain, so the two steps that relied on the stable branch default now pass toolchain: stable. The MSRV step already passes its own toolchain.

The pin follows the template's reasoning: the stable branch is rebased onto every master commit, so a SHA taken from it stops being reachable from any branch (4cda84d5 is already in that state).

Verification

• gh api repos/dtolnay/rust-toolchain/pulls/187 gives merge commit e2a55d2f, and branches/master points at it.
• Both files parse as YAML. CI on this PR runs the tokens and MSRV jobs with the new pin. The Dependencies workflow runs weekly and on dispatch only.