fix(rust): clippy 1.95 unnecessary_sort_by + pin toolchain

Two-part fix for the CI break that followed the previous push.

Lint fix:
`crates/headroom-core/src/transforms/smart_crusher/analyzer.rs:779` used
`pairs.sort_by(|a, b| b.1.cmp(&a.1))`. Clippy 1.95 introduced
`unnecessary_sort_by` and prefers `sort_by_key(|b|
std::cmp::Reverse(b.1))` for the same desc-sort by a single field.
Replaced. Functionally identical (both stable sorts on the count field
descending; first-occurrence tie order preserved either way).

Drift fix:
The same lint passed locally on rust 1.92 / clippy 0.1.92 because the
dev box hadn't been updated since December. CI runners use
`dtolnay/rust-toolchain@stable` which always grabs the latest stable
(1.95 today), so any lint added between local's last update and CI's
runner image breaks the pre-push gate. Two ways to close this:
1. Pin a specific Rust version in `rust-toolchain.toml`.
2. Run `rustup update stable` before every push.

Option 1 is more robust — `rust-toolchain.toml` is auto-respected by
`cargo`, so any local check (or CI check using the same project) syncs
to the pinned version automatically. Pinned to `1.95.0`. Bump procedure
documented in the file: edit channel, `rustup update`, `make
ci-precheck`, fix any new lints, commit.

Verification:
- `rustup` synced the dev box to 1.95.0 on the next `cargo` invocation.
- `cargo clippy --workspace -- -D warnings` clean on 1.95.
- `make ci-precheck` green (388 rust + 185 python + commitlint).

crates/headroom-core/src/transforms/smart_crusher/analyzer.rs

@@ -776,7 +776,7 @@ fn top_n_by_count(strs: &[&str], n: usize) -> Vec<(String, usize)> {
 
     // Stable sort by count desc preserves first-occurrence tie order.
     let mut pairs: Vec<(&&str, usize)> = order.iter().map(|k| (k, counts[k])).collect();
-    pairs.sort_by(|a, b| b.1.cmp(&a.1));
+    pairs.sort_by_key(|b| std::cmp::Reverse(b.1));
 
     pairs
         .into_iter()

rust-toolchain.toml

@@ -1,4 +1,16 @@
 [toolchain]
-channel = "stable"
+# Pin to a specific stable version so CI and local use the EXACT same
+# compiler. With `channel = "stable"`, CI runners (dtolnay/rust-
+# toolchain@stable) always grab the latest stable while local dev
+# machines run whatever version was last installed — a clippy lint
+# added in a newer stable then breaks CI without firing locally
+# (this happened on 2026-04-27: `unnecessary_sort_by` landed in
+# clippy 1.95 while a dev box had 1.92). Pinning makes "passes
+# locally" = "passes in CI" for every check that depends on the
+# toolchain.
+#
+# Bump procedure: edit the channel string here, run `rustup update`,
+# run `make ci-precheck`, fix any new lints, commit.
+channel = "1.95.0"
 components = ["rustfmt", "clippy"]
 profile = "minimal"