fix(rust): pin rust to a version available on fedora repo

[binujp]

Fedora pushed out rust 1.94.1 and we had pinned to 1.94.0. Given 1.94.0-1 went out before this, the repo does not have 1.94 rpms anymore. We pin to 1.94.1 to make sure we have two upgrades before having to do this again.

Koji build is stuck on the nigtly build wall. Creating the PR to not loose track.

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

Change Log

• Change
• Change
• Change

Does this affect the toolchain?

YES/NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

• Pipeline build id: xxxx

[Copilot]

Pull request overview

Pins the rust component’s upstream Fedora spec source to a specific Fedora dist-git commit so the build uses a Rust version that’s still available in Fedora 43 repos (avoiding breakage when older Rust RPMs are garbage-collected).

Changes:

• Replace the Fedora snapshot-based spec pin with an upstream-commit pin for rust.
• Update the in-file rationale comment to reference the new pin intent/version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

When pinning a component via spec.upstream-commit, this repo’s guidance expects a reference link (e.g., Fedora dist-git commit URL) and an explicit TODO/exit condition for removing the pin once the default snapshot advances. Please add a comment like other pinned components (e.g., golang) with the Fedora commit URL for b431103e… and when/how to drop the override.

Suggested change

	# Fedora repo does not host 1.93, which the spec gets pinned to. Fetch
	# spec from a more recent commit to pickup version - 1.94.1.
	# Fedora 43's default imported snapshot is older than the rust spec we need here.
	# Pin to the newer Fedora dist-git commit that carries rust 1.94.1:
	# https://src.fedoraproject.org/rpms/rust/c/b431103e3e71d30dda680c95d2f5d4fe50003436
	# TODO: Drop `upstream-commit` once the default Fedora 43 snapshot imported by this
	# repo advances to include this commit (or a newer rust spec with 1.94.1+), then
	# fall back to the normal upstream Fedora source selection.

[Copilot]

Minor grammar/wording: “pickup” should be “pick up” (e.g., “pick up version 1.94.1”).

Suggested change

	# spec from a more recent commit to pickup version - 1.94.1.
	# spec from a more recent commit to pick up version - 1.94.1.

[Copilot]

The PR description says we were previously pinned to Rust 1.94.0 and are moving to 1.94.1 due to Fedora repo availability, but the in-file comment focuses on 1.93 being unavailable. Please align the comment with the actual motivation (or update the PR description) so future readers understand why this upstream commit pin exists.

[christopherco]