Align CI Rust toolchain with rust-toolchain.toml

Update release workflow and documentation to read the Rust toolchain
version from rust-toolchain.toml and pass it explicitly to the
dtolnay/rust-toolchain action. This ensures the workflow uses a single
source of truth for the Rust version and avoids implicit action
behavior.

Author: setoelkahfi

.agents/skills/smbcloud-cli-release/SKILL.md

@@ -140,7 +140,9 @@ The npm CLI detects the GitHub OIDC environment automatically and exchanges it f
 
 When cross-compiling in CI, the Rust toolchain used for `rustup target add` must match the toolchain used by `cargo build`.
 
-For this repo, check `rust-toolchain.toml` first and keep the workflow matrix aligned with it.
+For this repo, `rust-toolchain.toml` is the source of truth.
+
+Do not duplicate the Rust version in the matrix unless the workflow intentionally tests multiple toolchains.
 
 If the workflow installs a target for one toolchain but Cargo builds with another, CI can fail with:
 
@@ -149,13 +151,23 @@ If the workflow installs a target for one toolchain but Cargo builds with anothe
 
 This can happen even when `rustup target add <target>` already ran successfully.
 
-Preferred pattern:
+### dtolnay action behavior
+
+For the pinned `dtolnay/rust-toolchain` revision used in this repo, do not assume the action will infer the toolchain from `rust-toolchain.toml` without input.
+
+A workflow can fail with:
+
+- `'toolchain' is a required input`
+
+Preferred pattern in this repo:
 
-- install the requested toolchain explicitly
-- run `rustup target add <target> --toolchain <toolchain>`
-- run `cargo +<toolchain> build --target <target>`
+- read `channel = "..."` from `rust-toolchain.toml`
+- write it to `RUST_TOOLCHAIN` in `GITHUB_ENV`
+- pass `toolchain: ${{ env.RUST_TOOLCHAIN }}` to `dtolnay/rust-toolchain`
+- run `rustup target add <target> --toolchain ${{ env.RUST_TOOLCHAIN }}`
+- run `cargo build --target <target>` after the action sets that toolchain active
 
-Do not rely on plain `cargo build` if the repo pin in `rust-toolchain.toml` can differ from the matrix toolchain version.
+This keeps `rust-toolchain.toml` as the only Rust version source while avoiding implicit action behavior.
 
 ### Trusted publisher command
 

.github/workflows/release-npm.yml

@@ -75,13 +75,26 @@ jobs:
 
           echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
 
+      - name: Read Rust toolchain
+        shell: bash
+        run: |
+          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
+          if [ -z "$rust_toolchain" ]; then
+            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
+            exit 1
+          fi
+
+          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"
+
       - name: Install toolkit
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
 
       - name: Install Rust target
         shell: bash
         run: |
-          rustup target add ${{ matrix.build.TARGET }}
+          rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}
           rustup target list --installed
 
       - name: Create .env file