fix(ci): unblock main — pin wasmtime example to toolchain MSRV + trigger CI on examples/**

.github/workflows/rust.yml

@@ -9,6 +9,13 @@ on:
     branches: [main]
     paths:
       - 'src/**'
+      # The `cargo` job's "Build Examples"/"Test Wasmtime Example" steps build
+      # examples/wasmtime-loader, so changes there must trigger this workflow.
+      # Without this, a breaking example-only change (e.g. a dependabot bump
+      # past the pinned toolchain's MSRV) merges unvalidated and then fails the
+      # next unrelated src/** push — which is how main went red (#285).
+      - 'examples/**'
+      - 'rust-toolchain.toml'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'BUILD.bazel'
@@ -17,6 +24,8 @@ on:
   pull_request:
     paths:
       - 'src/**'
+      - 'examples/**'
+      - 'rust-toolchain.toml'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - 'BUILD.bazel'

examples/wasmtime-loader/Cargo.toml

@@ -2,10 +2,20 @@
 name = "wasmtime-loader"
 version = "0.1.0"
 edition = "2021"
+# Pinned to the repo toolchain (rust-toolchain.toml channel = "1.94.0"). This
+# makes cargo's MSRV-aware resolver pick dependency versions that actually
+# build here, so an incompatible bump fails fast with a clear MSRV message
+# instead of surfacing as an opaque "requires rustc 1.96.0" build error in CI.
+rust-version = "1.94"
 
 [dependencies]
 wsc = { path = "../../src/lib" }
-wasmtime = "49.0"
+# wasmtime 48.x requires rustc 1.95 and 49.x requires rustc 1.96, both newer
+# than the pinned 1.94.0 toolchain; 47.x is the newest line with MSRV 1.94.
+# Raising this requires bumping rust-toolchain.toml first, which re-qualifies
+# every formal-verification gate (Kani/Verus/Rocq/witness) and so belongs in
+# its own PR. See the toolchain-bump follow-up issue.
+wasmtime = "47.0"
 anyhow = "1.0"
 env_logger = "0.11"
 log = "0.4"