Rust: Update rust-analyzer to 0.0.356

[github-actions]

Updates the ra_ap_* crates from 0.0.352 to 0.0.356 (all aligned), following rust/updating-rust-analyzer.md.

Updater output

rust/scripts/update_rust_analyzer.py committed the Cargo upgrade, then failed at step 2: it computed the source tag from the crates.io release date of ra_ap_syntax 0.0.356 (2026-10-01), but the rust-analyzer tag is 2026-09-28 (404). The remaining steps were finished manually. The script's tag lookup may need a fix (e.g. use the nearest preceding tag).

Changes

• Cargo dependency upgrade (from the updater).
• MODULE.bazel: RUST_ANALYZER_SRC_TAG is now 2026-09-28, with a recomputed integrity hash.
• Fixed toolchain set to 1.99.0, the latest stable release before the new rust-analyzer. Not built or tested against, since Bazel's RUST_VERSION is unchanged.
• Vendored Bazel cargo dependencies regenerated.
• Codegen: new CfgPredExpr and CfgPredPat nodes (ast.py, rust.dbscheme, extractor and QL generated code).
• Schema upgrade script (full compatibility), partial-compatibility downgrade script, and a change note.

Validation

• bazel run (rust/redacted) ran, and so did bazel run (rust/redacted):install` (succeeds).
• rust/lint.py ran. It also touched unrelated shared/ and unified/ files, so I reverted those.
• No Bazel test targets are defined for (rust/redacted) or (rust/redacted)
• CI could not be awaited, so it has not run on this PR. The QL tests, integration tests and DCA have not been run.

Known gaps

• The codeql CLI was unavailable, so the generated .qll files were not formatted with codeql query format. They were generated with a stub formatter. Run codegen with a real CLI: bazel run (rust/redacted) -- --codeql-binary=(path).
• .expected files and new tests for CfgPredExpr and CfgPredPat were not generated (codegen warns that there is no test source for them).
• The upgrade and downgrade scripts have not been exercised against a database.
• DCA with database caching disabled is still to do.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• go.dev
• golang.google.cn

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "go.dev"
    - "golang.google.cn"

See Network Configuration for more information.

Generated by 🦀 Update rust-analyzer · copilot · auto · 68.4 AIC · ⌖ 12.9 AIC · ⊞ 7.2K · ◷