chore(deps): master version-bump consolidation (closes #313, #314, #315)

[doublegate]

Summary

Consolidates the three open Dependabot PRs (#313, #314, #315) into one reviewed change, plus a full workspace cargo update sweep and a survey of everything else in the tree for anything further that's safely bumpable.

• Closes chore(ci): bump actions/setup-python from 6 to 7 #313 — CI actions/setup-python v6 → v7 (MkDocs step in web.yml)
• Closes chore(deps)(deps): bump the production-dependencies group with 9 updates #314 — the production-dependencies Dependabot group (9 Cargo.lock-only patch bumps: bitflags, bytemuck, cc, clap, futures-core/-macro/-sink/-task/-util, serde_json)
• Closes chore(deps)(deps): bump lz4_flex from 0.13.1 to 0.14.0 #315 — lz4_flex 0.13 → 0.14 (save-state/movie compression; default-features = false + safe-encode/safe-decode retained)
• Plus a workspace-wide cargo update: tokio 1.53.0 → 1.53.1 (also drops its transitive windows-sys/windows_* 0.53.x deps entirely — upstream no longer needs them), clap/clap_derive → 4.6.3

All Cargo.lock-only or single-line CI edits — zero source changes, deterministic #![no_std] core untouched.

What else was surveyed and intentionally left alone

• getrandom 0.2.17 (wasm32 target) — pulled transitively via ring (rustls/tungstenite/ureq); ring hasn't moved off getrandom ^0.2 upstream. Outside our control.
• wgpu/naga 30.0.0 — blocked because egui-wgpu 0.35.0 (the newest egui release) still requires wgpu = "^29.0". Bumping wgpu alone would split the tree across two incompatible wgpu majors; stays in the existing egui 0.35 / wgpu 29 / winit 0.30.13 / accesskit 0.24.1 tier until egui itself moves.
• All other GitHub Actions in .github/workflows/*.yml are already pinned to their current major tag (checkout@v7, upload-artifact@v7, etc.), which floats to the latest point release automatically — verified against each action's latest GitHub release.
• Android/iOS Gradle and Swift package dependency versions — intentionally out of scope. Those are their own separately-verified trains per project convention (see the v1.8.8 "Atlas" AGP/Kotlin coordination and the iOS dep-refresh history in project memory); bumping them isn't verifiable without an Android/Xcode toolchain and risks breaking builds I can't test locally.

Bonus

Adds .coderabbit.yaml so CodeRabbit is pre-configured as an alternate PR review bot (Gemini's daily review quota has been hit before).

Testing

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p rustynes-frontend --all-targets --features scripting -- -D warnings
• cargo clippy -p rustynes-frontend --all-targets --features scripting,hd-pack -- -D warnings
• cargo clippy -p rustynes-frontend --all-targets --features retroachievements -- -D warnings
• cargo test --workspace
• cargo build --workspace / cargo build --release --workspace

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation

  • Updated the Unreleased changelog with a consolidated dependency version update, including the verification steps run (formatting checks, clippy with warnings treated as errors, and full workspace tests).

• Chores

  • Updated the Pages build workflow to use the newer Python setup action for the MkDocs build.
  • Bumped the compression library to the next minor version and enabled the required alloc support while keeping existing safety/encode-decode behavior.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d94c5751-e48e-47ec-bc19-adb7355f5b53

📥 Commits

Reviewing files that changed from the base of the PR and between 6a82141 and 355dfab.

📒 Files selected for processing (1)

• .coderabbit.yaml

---

📝 Walkthrough

Walkthrough

The PR adds CodeRabbit configuration, updates the Pages workflow’s Python setup action, bumps the workspace lz4_flex dependency with the alloc feature, and records consolidated dependency updates and validation commands in the changelog.

Changes

Review configuration

Layer / File(s)	Summary
CodeRabbit review policy .coderabbit.yaml	Adds global review behavior, pre-merge checks, path filters, and subsystem-specific instructions.
CodeRabbit tools and knowledge settings .coderabbit.yaml	Configures analysis tools, chat auto-replies, web search, and scoped knowledge-base learning.

Dependency and CI updates

Layer / File(s)	Summary
Workspace dependency version update Cargo.toml, CHANGELOG.md	Updates lz4_flex from 0.13 to 0.14, enables alloc alongside the existing safe features, and documents consolidated dependency bumps and verification commands.
Pages workflow action update .github/workflows/web.yml	Updates actions/setup-python from v6 to v7.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	.coderabbit.yaml is a substantial tooling/config addition unrelated to the dependency-bump issues.	Move the CodeRabbit configuration to a separate PR unless it is explicitly required for this dependency update.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: consolidating dependency version bumps and closing the related Dependabot issues.
Linked Issues check	✅ Passed	The PR satisfies the linked dependency upgrades, including setup-python v7, production crate bumps, and lz4_flex 0.14 with alloc.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Docs-As-Spec Sync	✅ Passed	No files under crates/rustynes-{cpu,ppu,apu,mappers} or matching docs changed; the PR only touches config, changelog, and lockfile, and the body says zero source changes.
Changelog Entry For User-Visible Changes	✅ Passed	CHANGELOG.md has an Unreleased → Changed entry covering the dependency/version bumps and CI/tooling updates, so the requirement is satisfied.
No Unwrap/Expect/Panic On Untrusted Input	✅ Passed	PR touches only config/docs/Cargo.toml/Cargo.lock; no Rust source was changed and no new unwrap/expect/panic appears in modified files.
Safety Comment On New Unsafe Blocks	✅ Passed	Full PR diff changes only config/docs/Cargo.toml/lock/workflow; no added unsafe {} blocks or unsafe fn appear in code.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-master-version-bump-2026-07-20

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Consolidates multiple dependency bumps (three Dependabot PRs + a workspace cargo update) into a single change, along with a small CI workflow update and a new CodeRabbit configuration file.

Changes:

• Bump lz4_flex to 0.14 and refresh Cargo.lock with multiple transitive updates (e.g., tokio, clap, thiserror, toml, etc.).
• Update GitHub Pages/MkDocs workflow to use actions/setup-python@v7.
• Add .coderabbit.yaml to preconfigure CodeRabbit as an additional PR review bot.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
CHANGELOG.md	Adds an Unreleased “Changed” entry describing the dependency consolidation (needs version-number corrections to match Cargo.lock).
Cargo.toml	Updates the workspace lz4_flex dependency to 0.14 (needs alloc feature enabled when default-features = false).
Cargo.lock	Workspace-wide lockfile refresh reflecting the consolidated dependency updates.
.github/workflows/web.yml	Bumps actions/setup-python from v6 to v7 for the MkDocs step.
.coderabbit.yaml	Introduces CodeRabbit configuration (review preferences + path-specific instructions).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[doublegate]

@coderabbitai re: the "Out of Scope Changes" pre-merge check on .coderabbit.yaml — leaving it in this PR intentionally rather than splitting it out. Context: Gemini hit its daily review quota partway through this PR's review cycle (see its comment above), and the maintainer asked for CodeRabbit to be wired up as a fallback reviewer right then, in this same PR, so it could actually participate in reviewing the rest of these changes rather than waiting for a follow-up PR. It's a pure tooling addition (a new config file, zero behavior change to the shipped emulator), so it doesn't carry any of the risk the check is designed to catch. Happy to split it into its own PR next time a config-only change like this comes up outside a live review-quota gap.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@doublegate Thanks for the context. The .coderabbit.yaml addition is justified here: it enabled a fallback reviewer during the active review cycle, is tooling-only, and does not alter emulator runtime behavior or the no_std core. I’m withdrawing the out-of-scope concern for this PR.

[doublegate]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[doublegate]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[doublegate]

@coderabbitai configuration

[coderabbitai]

Configuration used: Path: .coderabbit.yaml

CodeRabbit configuration

# Source: Repository YAML (base)
language: en-US
# Source: Repository YAML (base)
tone_instructions: Precise, technical language. No emojis or poems. Prioritize determinism and no_std/unsafe-boundary correctness in rustynes-* chip crates over style nits clippy/rustfmt/markdownlint already catch in CI.
# Source: defaults
early_access: false
# Source: defaults
enable_free_tier: true
# Source: defaults
inheritance: false
reviews:
  # Source: Repository YAML (base)
  profile: assertive
  # Source: Repository YAML (base)
  request_changes_workflow: false
  # Source: Repository YAML (base)
  high_level_summary: true
  # Source: defaults
  high_level_summary_instructions: ''
  # Source: defaults
  high_level_summary_placeholder: '`@coderabbitai` summary'
  # Source: defaults
  high_level_summary_in_walkthrough: false
  # Source: defaults
  auto_title_placeholder: '`@coderabbitai`'
  # Source: defaults
  auto_title_instructions: ''
  # Source: Repository YAML (base)
  review_status: true
  # Source: defaults
  review_details: false
  # Source: defaults
  review_progress: true
  # Source: defaults
  commit_status: true
  # Source: defaults
  fail_commit_status: false
  # Source: Repository YAML (base)
  collapse_walkthrough: true
  # Source: Repository YAML (base)
  changed_files_summary: true
  # Source: Repository YAML (base)
  sequence_diagrams: true
  # Source: Repository YAML (base)
  estimate_code_review_effort: true
  # Source: Repository YAML (base)
  assess_linked_issues: true
  # Source: Repository YAML (base)
  related_issues: true
  # Source: Repository YAML (base)
  related_prs: true
  # Source: Repository YAML (base)
  suggested_labels: true
  # Source: defaults
  labeling_instructions: []
  # Source: defaults
  mutually_exclusive_groups: {}
  # Source: Repository YAML (base)
  auto_apply_labels: false
  # Source: Repository YAML (base)
  suggested_reviewers: true
  # Source: Repository YAML (base)
  auto_assign_reviewers: false
  # Source: defaults
  suggested_reviewers_instructions: []
  # Source: defaults
  in_progress_fortune: true
  # Source: Repository YAML (base)
  poem: false
  # Source: defaults
  enable_prompt_for_ai_agents: true
  # Source: Repository YAML (base)
  path_filters:
    - '!ref-proj/**'
    - '!ref-docs/**'
    - '!docs/archive/**'
    - '!to-dos/archive/**'
    - '!Cargo.lock'
    - '!crates/rustynes-cheevos/vendor/**'
  # Source: Repository YAML (base)
  path_instructions:
    - path: crates/rustynes-cpu/**
      instructions: |
        This is a #![no_std] deterministic 6502 core validated against nestest and the blargg/kevtris/AccuracyCoin test-ROM suites. Flag anything that could introduce non-determinism (wall-clock, OS RNG, unordered iteration) or break cycle-accuracy.
    - path: crates/rustynes-ppu/**
      instructions: |
        PPU-dot-resolution lockstep timing is load-bearing (see docs/scheduler.md). Flag any change that could shift sub-instruction PPU event timing without an accompanying test-ROM justification.
    - path: crates/rustynes-apu/**
      instructions: |
        Audio synthesis must stay byte-identical to the golden vectors in tests/golden/ unless the PR explicitly re-blesses them.
    - path: crates/rustynes-core/**
      instructions: |
        The Bus owns all mutable subsystem state; the CPU/PPU/APU each see only the narrow trait (PpuBus/ApuBus) they need. Flag any change that widens a crate's access beyond that, or that could break save-state / TAS movie / netplay-replay format compatibility without an accompanying format-version bump (see ADR 0028).
    - path: crates/*/Cargo.toml
      instructions: |
        This workspace pins a single compatible egui/wgpu/winit/naga/ accesskit tier (currently egui 0.35 / wgpu 29 / winit 0.30.13 / accesskit 0.24.1). Flag a version bump to any one of these crates that isn't accompanied by matching bumps to the others, or that would require two incompatible major versions of the same transitive dependency to coexist.
    - path: android/**/*.kt
      instructions: |
        Kotlin/Compose Android app. Flag Compose recomposition footguns (unstable lambdas/params causing unnecessary recomposition) and any direct filesystem/SharedPreferences access that bypasses the existing UniFFI bridge to rustynes-mobile.
    - path: '**/*.swift'
      instructions: |
        SwiftUI/Metal iOS app calling into rustynes-mobile via UniFFI- generated bindings. Flag force-unwraps (`!`) on values that originate from the Rust bridge or from user/file I/O.
    - path: scripts/**/*.py
      instructions: |
        One-off developer tooling, not shipped product code. Prioritize correctness and clear error messages over style; don't ask for packaging/type-hints polish unless it affects correctness.
    - path: .github/workflows/**
      instructions: |
        Flag unpinned third-party actions (should be pinned to a version tag or commit SHA, not a branch), missing least-privilege `permissions:` blocks, and secrets echoed into logs.
    - path: '**/*.md'
      instructions: |
        Docs are the spec here, not a changelog. Flag documentation that drifts from the code it describes rather than just prose nits. This repo's markdownlint gate is pinned to v0.39.0 via pre-commit (see CLAUDE.md) — don't flag rules that version doesn't have.
  # Source: defaults
  abort_on_close: true
  # Source: defaults
  disable_cache: false
  slop_detection:
    # Source: Repository YAML (base)
    enabled: true
  auto_review:
    # Source: Repository YAML (base)
    enabled: true
    # Source: defaults
    description_keyword: ''
    # Source: Repository YAML (base)
    auto_incremental_review: true
    # Source: defaults
    auto_pause_after_reviewed_commits: 5
    # Source: Repository YAML (base)
    ignore_title_keywords:
      - WIP
      - DO NOT REVIEW
    # Source: defaults
    labels: []
    # Source: Repository YAML (base)
    drafts: false
    # Source: defaults
    base_branches: []
    # Source: defaults
    ignore_usernames: []
  finishing_touches:
    docstrings:
      # Source: Repository YAML (base)
      enabled: true
    unit_tests:
      # Source: Repository YAML (base)
      enabled: true
    simplify:
      # Source: Repository YAML (base)
      enabled: false
    autofix:
      # Source: Repository YAML (base)
      enabled: true
    fix_ci:
      # Source: defaults
      enabled: true
    resolve_merge_conflict:
      # Source: defaults
      enabled: true
    # Source: defaults
    custom: []
  pre_merge_checks:
    # Source: defaults
    override_requested_reviewers_only: false
    docstrings:
      # Source: Repository YAML (base)
      mode: warning
      # Source: Repository YAML (base)
      threshold: 80
    title:
      # Source: Repository YAML (base)
      mode: warning
      # Source: defaults
      requirements: ''
    description:
      # Source: Repository YAML (base)
      mode: warning
    issue_assessment:
      # Source: Repository YAML (base)
      mode: warning
    # Source: Repository YAML (base)
    custom_checks:
      - mode: warning
        name: Docs-as-spec sync
        instructions: |
          If this PR changes observable behavior in crates/rustynes-cpu, crates/rustynes-ppu, crates/rustynes-apu, or crates/rustynes-mappers (not just internal refactoring), the matching docs/<subsystem>.md file should be updated in the same PR. Fail if a chip-behavior change has no corresponding docs change and the PR body doesn't explain why one isn't needed.
      - mode: warning
        name: CHANGELOG entry for user-visible changes
        instructions: |
          If this PR changes user-visible behavior, adds a feature, or fixes a user-facing bug, CHANGELOG.md should gain an entry under [Unreleased]. Pass for pure-internal refactors, dependency-only bumps with no behavior change, or CI/tooling-only changes.
      - mode: warning
        name: No unwrap/expect/panic on untrusted input
        instructions: |
          Flag any new `.unwrap()`, `.expect()`, or `panic!()` applied to data parsed from an external/untrusted source (ROM/save-state/ movie file bytes, network/netplay messages, user-supplied paths) outside of #[cfg(test)] code. These boundaries must return a typed Result/error instead. Pass if the unwrap/expect is on a value the code just constructed or an invariant already checked nearby.
      - mode: warning
        name: SAFETY comment on new unsafe blocks
        instructions: |
          Every new `unsafe { ... }` block or `unsafe fn` must have an adjacent `// SAFETY:` comment explaining the invariant the caller upholds. Fail if a new unsafe block has no such comment nearby.
  # Source: defaults
  post_merge_actions: []
  tools:
    ast-grep:
      # Source: defaults
      rule_dirs: []
      # Source: defaults
      util_dirs: []
      # Source: Repository YAML (base)
      essential_rules: true
      # Source: defaults
      packages: []
    shellcheck:
      # Source: Repository YAML (base)
      enabled: true
    ruff:
      # Source: Repository YAML (base)
      enabled: true
    markdownlint:
      # Source: Repository YAML (base)
      enabled: true
    github-checks:
      # Source: defaults
      enabled: true
      # Source: defaults
      timeout_ms: 90000
    languagetool:
      # Source: defaults
      enabled: true
      # Source: defaults
      enabled_rules: []
      # Source: defaults
      disabled_rules: []
      # Source: defaults
      enabled_categories: []
      # Source: defaults
      disabled_categories: []
      # Source: defaults
      enabled_only: false
      # Source: defaults
      level: default
    biome:
      # Source: defaults
      enabled: true
    hadolint:
      # Source: Repository YAML (base)
      enabled: true
    swiftlint:
      # Source: Repository YAML (base)
      enabled: true
    phpstan:
      # Source: Repository YAML (base)
      enabled: false
      # Source: defaults
      level: default
    phpmd:
      # Source: Repository YAML (base)
      enabled: false
    phpcs:
      # Source: Repository YAML (base)
      enabled: false
    golangci-lint:
      # Source: defaults
      enabled: true
    yamllint:
      # Source: Repository YAML (base)
      enabled: true
    gitleaks:
      # Source: Repository YAML (base)
      enabled: true
    trufflehog:
      # Source: Repository YAML (base)
      enabled: true
    checkov:
      # Source: Repository YAML (base)
      enabled: false
    tflint:
      # Source: Repository YAML (base)
      enabled: false
    detekt:
      # Source: Repository YAML (base)
      enabled: true
    eslint:
      # Source: defaults
      enabled: true
      e18e:
        # Source: defaults
        enabled: true
    flake8:
      # Source: Repository YAML (base)
      enabled: false
    fbinfer:
      # Source: Repository YAML (base)
      enabled: false
      # Source: defaults
      enable_java: false
    fortitudeLint:
      # Source: defaults
      enabled: true
    rubocop:
      # Source: Repository YAML (base)
      enabled: false
    buf:
      # Source: Repository YAML (base)
      enabled: false
    regal:
      # Source: Repository YAML (base)
      enabled: false
    actionlint:
      # Source: Repository YAML (base)
      enabled: true
    zizmor:
      # Source: Repository YAML (base)
      enabled: true
    pmd:
      # Source: Repository YAML (base)
      enabled: false
    clang:
      # Source: Repository YAML (base)
      enabled: true
    cppcheck:
      # Source: Repository YAML (base)
      enabled: true
    opengrep:
      # Source: Repository YAML (base)
      enabled: true
    semgrep:
      # Source: Repository YAML (base)
      enabled: true
    circleci:
      # Source: Repository YAML (base)
      enabled: false
    clippy:
      # Source: Repository YAML (base)
      enabled: true
    sqlfluff:
      # Source: Repository YAML (base)
      enabled: false
    squawk:
      # Source: Repository YAML (base)
      enabled: false
    trivy:
      # Source: defaults
      enabled: true
    prismaLint:
      # Source: Repository YAML (base)
      enabled: false
    pylint:
      # Source: Repository YAML (base)
      enabled: false
    oxc:
      # Source: defaults
      enabled: true
    shopifyThemeCheck:
      # Source: Repository YAML (base)
      enabled: false
    luacheck:
      # Source: Repository YAML (base)
      enabled: true
    brakeman:
      # Source: Repository YAML (base)
      enabled: false
    dotenvLint:
      # Source: Repository YAML (base)
      enabled: false
    htmlhint:
      # Source: Repository YAML (base)
      enabled: false
    stylelint:
      # Source: Repository YAML (base)
      enabled: false
    checkmake:
      # Source: Repository YAML (base)
      enabled: true
    osvScanner:
      # Source: Repository YAML (base)
      enabled: true
    oasdiff:
      # Source: Repository YAML (base)
      enabled: false
    reactDoctor:
      # Source: Repository YAML (base)
      enabled: false
    presidio:
      # Source: defaults
      enabled: true
    blinter:
      # Source: Repository YAML (base)
      enabled: false
    smartyLint:
      # Source: Repository YAML (base)
      enabled: false
    emberTemplateLint:
      # Source: Repository YAML (base)
      enabled: false
    skillspector:
      # Source: defaults
      enabled: true
    psscriptanalyzer:
      # Source: Repository YAML (base)
      enabled: false
chat:
  # Source: defaults
  art: true
  # Source: defaults
  allow_non_org_members: true
  # Source: Repository YAML (base)
  auto_reply: true
  integrations:
    jira:
      # Source: defaults
      usage: auto
    linear:
      # Source: defaults
      usage: auto
knowledge_base:
  # Source: Repository YAML (base)
  opt_out: false
  web_search:
    # Source: Repository YAML (base)
    enabled: true
  code_guidelines:
    # Source: Repository YAML (base)
    enabled: true
    # Source: Repository YAML (base)
    filePatterns:
      - '**/AGENTS.md'
      - '**/CLAUDE.md'
      - docs/dev/CONTRIBUTING.md
      - docs/testing-strategy.md
      - docs/architecture.md
  learnings:
    # Source: Repository YAML (base)
    scope: auto
    # Source: defaults
    approval_delay: 0
  issues:
    # Source: Repository YAML (base)
    scope: auto
  jira:
    # Source: defaults
    usage: auto
    # Source: defaults
    project_keys: []
  linear:
    # Source: defaults
    usage: auto
    # Source: defaults
    team_keys: []
  pull_requests:
    # Source: Repository YAML (base)
    scope: auto
  mcp:
    # Source: defaults
    usage: auto
    # Source: defaults
    disabled_servers: []
  # Source: defaults
  automatic_repository_linking: false
  # Source: defaults
  linked_repositories: []
code_generation:
  docstrings:
    # Source: defaults
    path_instructions: []
  unit_tests:
    # Source: defaults
    path_instructions: []
issue_enrichment:
  auto_enrich:
    # Source: defaults
    enabled: false
  planning:
    # Source: defaults
    enabled: true
    auto_planning:
      # Source: defaults
      enabled: true
      # Source: defaults
      labels: []
  labeling:
    # Source: defaults
    labeling_instructions: []
    # Source: defaults
    auto_apply_labels: false

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Around line 17-24: Shorten the folded-scalar value for tone_instructions to no
more than 250 characters while preserving its key requirements: precise
technical language, no emojis or poems, prioritization of correctness,
determinism, and no_std/unsafe-boundary issues, and avoidance of findings
already covered by CI tooling.

In @.github/workflows/web.yml:
- Line 120: Update the actions/setup-python step to reference the full immutable
commit SHA for the intended v7 release instead of the mutable `@v7` tag,
preserving the existing action configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ee14f60b-2189-4240-9a09-f94770c21e4b

📥 Commits

Reviewing files that changed from the base of the PR and between b49dd1e and 6a82141.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .coderabbit.yaml
• .github/workflows/web.yml
• CHANGELOG.md
• Cargo.toml

[doublegate]

@coderabbitai re: the "Out of Scope Changes" warning on `.coderabbit.yaml` (re-raised fresh by the full review) — same rationale as before, restating since a full review doesn't inherit an incremental review's earlier withdrawal: this is a zero-risk, zero-source-change tooling addition, added mid-PR because Gemini hit its daily review quota and a working fallback reviewer was needed for this PR, not a future one. It's flagged as a warning, not an error, so it doesn't block mergeable/mergeStateStatus (no branch protection on this repo requires the CodeRabbit check), and the overall CodeRabbit check already reports "pass". Keeping it in this PR rather than splitting it out — the alternative is a second PR + a full second CI+review cycle for a config file with no behavioral risk.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@doublegate The rationale remains sufficient. .coderabbit.yaml is a tooling-only addition needed to provide review coverage during this PR’s active review cycle; it does not alter shipped emulator behavior, the deterministic no_std core, or unsafe boundaries. The warning is not applicable here, so I’m withdrawing it.