test: pin appsec's nightly toolchain

[morrisonlevi]

Description

When I rebuilt these images this week, I didn't realize they were going to pick up an unpinned nightly. It's not a "problem" per-se, but it does create a bunch of warnings in the logs, such as this one in helper-rust integration coverage:

warning: use of deprecated method `std::sync::atomic::Atomic::<u64>::fetch_update`: renamed to `try_update` for consistency
  --> appsec/helper-rust/src/service/metrics.rs:22:14
   |
22 |             .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |s| {
   |              ^^^^^^^^^^^^
   |
   = note: `#[warn(deprecated)]` on by default
help: replace the use of the deprecated method
   |
22 -             .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |s| {
22 +             .try_update(Ordering::Relaxed, Ordering::Relaxed, |s| {
   |

But it's not actionable, as .try_update doesn't stabilize until 1.99 and our MSRV is only 1.91.

Version 2025-10-31 is near 1.91.1 and is the same version used elsewhere in our images. Pinning it removes a bunch of warnings.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T20:29:39.730807Z	3eb6a17	PR opened
🔒 Security Review	✅ Completed 2026-09-17T20:30:16.526723Z	3eb6a17	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1-2]

 

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 3 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | check libxml2 version

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | installer tests

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | publish docker image for system tests

View more details · View in GitLab

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 68.25% (+0.78%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3eb6a17 | Docs | View more details | Give us feedback!}

[cataphract]

IIRC nightly is only to rebuild std. Can't we use stable for building, but set RUSTC_BOOTSTRAP=1? That way we wouldn't even need to install the nightly toolchain.