* 🔧 Bump Rust version of the devenv image to 1.99
* 🔧 Run the pinned Rust setup from the lint and format scripts
./build and ./test switch to the Rust version in render-wasm/_build_env
through setup, but ./lint did not, and formatting called cargo fmt
directly. In CI both ran on the devenv image's default toolchain.
Make ./lint run setup and add a ./fmt script that does the same, so all
render-wasm entry points use the pinned version. CI and scripts/ci now
call ./fmt instead of cargo fmt.
AI-assisted-by: claude-opus-5-5
* 🚑 Drop invoke_* glue checks from staging CI
The .github backport from develop added check-no-invoke-v to WASM and
Exporter CI, but staging still ships glue that uses invoke_* wrappers.
Remove those steps (and the WASM production build only used by the
check) so staging CI matches the binary it builds.
* 🔧 Disable credential persistence in commit-checker checkout
zizmor fails CI: Workflows when actions/checkout omits
persist-credentials: false. Match the rest of the workflows.
