Merge M1's work: Rust toolchain pin + settings.local.json ignore

Reconciles the M5/M1 divergence from the rsync-based handoff. Both sides
had independently added the same .gitignore line; M1 also pinned the Rust
toolchain. Nothing dropped. M1 is a git remote from here on, so this
cannot recur.

FORK.md

@@ -15,6 +15,12 @@ npm run ship -- --dmg      # …and put an installer on the Desktop
 cd src-tauri && cargo test  # 26 tests, all pure logic
 ```
 
+`rust-toolchain.toml` at the project root pins the channel to `stable` and must be
+present. On a fresh machine that has never set a rustup default, `tauri-cli` calls
+`cargo metadata` without specifying a toolchain and panics in its metadata thread —
+not a clear error message, just an abort. The file guarantees the toolchain is always
+resolved correctly regardless of what the machine's rustup default is configured to.
+
 Read `README.md` for what it does and
 `docs/superpowers/specs/2026-09-01-work-app-design.md` for why it is built this way. The
 git history is included and the commit messages carry the reasoning — most of them

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "stable"