chore: establish phase 0 baseline

scripts/verify_rust_toolchain.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""Require the exact reviewed Rust compiler before running Rust quality gates."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+PIN = ROOT / "rust-toolchain.toml"
+
+
+def main() -> None:
+    with PIN.open("rb") as stream:
+        expected = tomllib.load(stream)["toolchain"]["channel"]
+    result = subprocess.run(
+        ["rustc", "--version"],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    match = re.match(r"rustc ([0-9]+\.[0-9]+\.[0-9]+)(?:\s|$)", result.stdout)
+    if match is None:
+        print(f"FAIL: could not parse compiler version: {result.stdout.strip()}", file=sys.stderr)
+        raise SystemExit(1)
+    actual = match.group(1)
+    if actual != expected:
+        print(
+            f"FAIL: rustc {actual} is active, but rust-toolchain.toml pins {expected}.\n"
+            "A distro-provided cargo/rustc may ignore rust-toolchain.toml; use the "
+            "pinned rustup toolchain or update the distro packages.",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+    print(f"PASS: exact Rust toolchain {actual}")
+
+
+if __name__ == "__main__":
+    main()