Pin the rust-test macOS lane to Rust 1.97.1 with a self-expiring canary

[ciaranra]

Summary

The rust-test macOS matrix lane fails on current stable: rustc 1.98.0 on aarch64-apple-darwin segfaults compiling ordinary dependency build scripts (libc, proc-macro2, quote) before any workspace crate builds. This is the same 1.98 aarch64-darwin crash that already pinned the python-compat-smoke macOS lane (issue #566); the rust-test lane was never pinned because its macOS job only runs on dispatch and pre-merge matrix runs.

Reproductions (identical signature, two dispatch runs on one branch plus dev itself):

• https://github.com/PECOS-packages/PECOS/actions/runs/33217804443 (branch)
• https://github.com/PECOS-packages/PECOS/actions/runs/33259733605 (branch, re-run)
• dev matrix runs on 2026-08-30 failed the same job the same way.

Change

• The Unix Rust setup step selects 1.97.1 on macos-latest and stable elsewhere (expression-level conditional; a matrix include would add a phantom macOS job on pull requests, where the matrix is ubuntu-only).
• A self-expiring canary step (macOS, non-PR events only, never fails the job) probes latest stable with five plain cargo check runs — this lane's actual crashing invocation, unlike the smoke lane's maturin-link-args probe — and emits a workflow warning when the pin looks obsolete, mirroring the smoke-lane pattern and its unpin discipline (issue Unpin macOS python-compat-smoke Rust toolchain once the rustc 1.98 aarch64-darwin segfault is fixed #566).

The canary block intentionally duplicates the smoke lane's shape rather than extracting a shared script: the two probes differ in the invocation under test, and this keeps the change to one workflow.

Verification

• Workflow YAML parses; repo pre-commit hooks pass on the file.
• A workflow_dispatch matrix run on this branch is the live proof: the macOS job should install 1.97.1 and pass where the two runs above segfaulted. Run: https://github.com/PECOS-packages/PECOS/actions/runs/33347969025

Unpin path is unchanged and tracked in #566: remove the pin only after the canary warning persists across several PRs and an unpinned build passes on a draft PR.

[ciaranra]

Live proof complete: the workflow_dispatch matrix run on this branch is fully green — rust-test (macos-latest) passes with the 1.97.1 pin (https://github.com/PECOS-packages/PECOS/actions/runs/33347969025), where the two unpinned runs cited in the description segfaulted in dependency build scripts. ubuntu and windows lanes unaffected and green.