Address Codex review: pin rust-toolchain from master, fix fail-on-finding default

dtolnay/rust-toolchain's convenience branches (stable/beta/nightly) get
rewritten over time, so a commit pinned there can become unreachable;
the upstream guidance is to pin a `master` commit and pass the channel
via an explicit `toolchain:` input instead.

docs/suppression-and-fp-policy.md had the Action's fail-on-finding
default backwards: action.yml sets it to "true" (fails on a finding by
default), not "false" -- the CLI (own-check.sh) is the one that
defaults to off. Corrected and clarified the CLI-vs-Action distinction.

Author: claude

.github/workflows/ci.yml

@@ -59,8 +59,9 @@ jobs:
         working-directory: rust
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable, 2026-07-09
+      - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master, 2026-07-10
         with:
+          toolchain: stable
           components: rustfmt, clippy
       - name: cargo fmt --check
         run: cargo fmt --check

docs/suppression-and-fp-policy.md

@@ -44,7 +44,7 @@ fire on unprovable input.
 | Lever | Status | Scope |
 |---|---|---|
 | `--severity warning` | **works today** (P-013) | Global: downgrades every error-tier finding for that run to advisory. Per-run, not per-finding — an escape hatch for "show me everything, but don't fail the build yet," not a way to silence one specific site. |
-| `--fail-on-finding` (off) | **works today** (P-013, the GitHub Action's default input) | Global: findings still print/annotate, but the process/step exit code stays 0. |
+| `--fail-on-finding` set to off | **works today** (P-013) | Global: findings still print/annotate, but the process/step exit code stays 0. The CLI (`own-check.sh`) is off by default — you must pass the flag to make findings fail the shell. The GitHub Action inverts that for safety: its `fail-on-finding` input defaults to `"true"` (fails the step on a finding), so to get the "annotate but don't fail" behavior in CI you must explicitly set `fail-on-finding: "false"`. |
 | `[OwnIgnore("reason")]` | **designed, not implemented** (P-004) | Inline, per-site suppression attribute — the intended fine-grained escape hatch for a specific subscription/field the checker can't see enough context to clear. Referenced across P-001/P-004/P-010/P-014/P-017 as the standing design; there is no code behind it yet. If you need this today, the honest answer is: you don't have it — file the case so it informs the implementation. |
 | Project-wide config (`.ownrc`/`own.toml`) | **draft, not implemented** (P-015) | Per-check-category enable/disable + severity + per-path overrides (e.g. relax a category under `tests/`). Stub status — format (TOML vs INI vs JSON) and enforcement point are still open questions in the proposal. |
 | `corpus/oracle-fp-baseline.txt` | **exists, but not a user-facing suppression tool** | An allowlist the *oracle comparator* (`scripts/oracle_compare.py`, a dev/maintainer tool) uses to keep already-triaged false positives out of the `own-only` bucket on re-runs. It doesn't change what `own-check`/the Action reports — it only keeps the oracle's own triage queue from re-showing confirmed noise. |