deps: bump to nightly-2026-08-28 + refresh the dep tree (and pin the old trait solver)

[annejan]

Moves the dated toolchain pin to nightly-2026-08-28, refreshes the whole dependency tree, and — the part worth reading — deliberately opts back out of rustc's new trait solver, because one dependency makes it unbuildable.

The trait solver

nightly-2026-08-28 is the first pin that carries the next-generation trait solver on by default (-Znext-solver=globally, rust-lang/rust#160619). Verified empirically rather than assumed from the date: default rustc diagnostics are byte-identical to -Znext-solver=globally and differ from =coherence.

Under it, bevy_render 0.19.1 needs ~13.3 GB RSS in a single rustc and is OOM-killed. The same crate, same toolchain, with -Znext-solver=coherence peaks at ~1.9 GB. Both measured with only the solver as the variable:

solver	peak single-rustc RSS	result
-Znext-solver=coherence (old)	~1.9 GB	builds, 9m10s
default / =globally (new)	~13.3 GB	OOM-killed

A ~7× memory regression takes out the 16 GB GitHub runners as surely as the dev box, so .cargo/config.toml now sets rustflags = ["-Znext-solver=coherence"] — the documented opt-out, which keeps the new solver for coherence checking (its default since 1.84) and the old one elsewhere, i.e. exactly the pre-bump behaviour.

The regression is confined to that one dependency. A full --release codegen of the martin bin under -Znext-solver=globally, with deps on the old solver, compiles clean — nothing in our code trips the new solver. So dropping the opt-out once upstream is fixed should be a one-line change, not a migration. CONTRIBUTING.md § The trait solver documents the why, the numbers, and the re-test recipe.

No upstream report seems to match this yet; it may be worth filing against rust-lang/rust.

Dependencies

Bevy 0.19.0 → 0.19.1, and 146 locked crates updated / 12 added / 2 removed (wgpu 29.0.4, quick-xml 0.41, uuid 1.26, thiserror 2.0.20, zerocopy 0.8.56; the new arboard/wl-clipboard-rs arrive with Bevy 0.19.1).

Every direct dependency was already at its latest major, so Cargo.toml's version requirements are untouched, and the bevy_gaussian_splatting fork rev is unchanged — martin-tightcut's head still matches the pinned commit. No source changes anywhere.

Two cargo-audit exceptions deleted

The refresh pulls quick-xml 0.41.0 (via wayland-scanner), which patches RUSTSEC-2026-0194 and RUSTSEC-2026-0195. Both ignores are gone from .cargo/audit.toml, and cargo audit passes clean over 650 crates — the gate now passes on its own merits instead of by exemption. Only the ttf-parser unmaintained warning (RUSTSEC-2026-0192) remains ignored, as before.

Also: the pinned-nightly date in README.md, CLAUDE.md and CONTRIBUTING.md was stale (all three still said 2026-04-26 while the toolchain file was on 2026-07-30); all now match rust-toolchain.toml.

Verification

Gate	Result
cargo fmt --all --check	pass
cargo clippy --all-targets -- -D warnings	pass, zero warnings
cargo test --release	176 passed, 0 failed
reuse lint	compliant, 253/253 files
cargo build --release --all-targets	clean
sh3 cargo check	pass
bundle cargo check (intro)	pass, 4 assets packed
cargo audit	clean, 650 crates
martin bin under -Znext-solver=globally	pass
--validate on all 55 shows	55/55
--synth-wav w/ MARTIN_SCORE_STRICT=1	89s rendered

⚠️ The GPU path is unverified

The container had no GPU and no software-Vulkan, so nothing in this PR actually rasterized a splat. A wgpu 29.0.4 bump is exactly the kind of change that only surfaces at draw time, and CI won't cover it either — its smoke-render is continue-on-error: true and typically skips on lavapipe. Please run pipeline/smoke-shows.py on real RADV before merging.

---

Generated by Claude Code