Install cargo-llvm-cov 0.9.0 from the tool manifest

.github/actions/generate-coverage/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+- Install `cargo-llvm-cov` from the tool manifest at 0.9.0, replacing the
+  `cargo-binstall` of 0.6.24. cargo 1.100 nightlies (from 2026-08-22) use
+  Cargo's new build-dir layout, which places test executables under
+  `debug/build/<package>/<hash>/out`; 0.6.24 searched `debug/deps` and failed
+  with `failed to collect object files` after every test had passed, which is
+  what statelet's coverage lane has reported since its toolchain moved to
+  nightly-2026-08-23. 0.9.0 reads the new layout. The installer resolves the
+  manifest entry with the `install-tool` resolver, downloads the release
+  archive, verifies its SHA-256 against the manifest, extracts only the named
+  member, stages it beside the destination and publishes it with a rename so
+  no reader sees a partial executable, and reuses an installed binary that
+  already reports exactly the pinned version. The `Ensure cargo-binstall` step
+  is removed, as nothing in this
+  action invokes `cargo binstall` any more, and `~/.cargo/bin/cargo-binstall`
+  leaves the Cargo cache paths.
 - Refuse a `publish-baseline` that is neither `auto` nor `always`, before the
   action restores anything, rather than treating an unrecognized value as
   `auto`.

.github/actions/generate-coverage/README.md

@@ -10,10 +10,12 @@ manifest, set `cargo-manifest` to point to a nested `Cargo.toml`. It installs
 the project dependencies plus `slipcover`, `pytest`, and `coverage`
 automatically via `uv` into an isolated throwaway virtual environment
 (`.venv-coverage`) before running the tests, so no system-level Python installs
-are required. When Rust coverage is required, `cargo-llvm-cov` is installed via
-a pinned `cargo-binstall`. `cargo-nextest` is downloaded directly from its
+are required. When Rust coverage is required, `cargo-llvm-cov` is installed from
+the repository's tool manifest (`.github/tool-manifest.toml`): the entry names
+the release archive and its SHA-256 digest per target, and the installer
+extracts only the named member. `cargo-nextest` is downloaded directly from its
 pinned official release; both the archive and extracted binary have fixed
-SHA-256 digests, and no Cargo source-build fallback exists. If both
+SHA-256 digests. Neither has a Cargo source-build fallback. If both
 configuration files are present, coverage is run for each language and the
 Cobertura reports are merged using `uvx merge-cobertura`.
 
@@ -203,7 +205,7 @@ With the default `cache-provider: github`, setup-uv retains its historical
 automatic policy: its GitHub cache is enabled on GitHub-hosted runners and
 disabled on self-hosted runners. The action also caches Cargo artefacts and
 Python dependencies with `actions/cache`. The Cargo cache covers the
-`cargo-binstall`, `cargo-llvm-cov`, and `cargo-nextest` binaries, the Cargo
+`cargo-llvm-cov` and `cargo-nextest` binaries, the Cargo
 registry, and the Cargo Git index. It no longer archives the `target` tree.
 
 Coverage builds an instrumented `target/llvm-cov-target` tree, whereas lint and

.github/actions/generate-coverage/action.yml

@@ -212,82 +212,13 @@ runs:
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
       with:
         path: |
-          ~/.cargo/bin/cargo-binstall
           ~/.cargo/bin/cargo-llvm-cov
           ~/.cargo/bin/cargo-nextest
           ~/.cargo/registry
           ~/.cargo/git
         key: ${{ runner.os }}-llvmcov-${{ hashFiles('**/Cargo.lock') }}
         restore-keys: |
           ${{ runner.os }}-llvmcov-
-    - name: Ensure cargo-binstall
-      if: steps.detect.outputs.lang == 'rust' || steps.detect.outputs.lang == 'mixed'
-      run: |
-        set -euo pipefail
-        # NOTE: BINSTALL_SHA256 pins and validates only the installer script
-        # (install-from-binstall-release.sh), not the cargo-binstall binary that
-        # the script subsequently downloads and executes.
-        #
-        # Keep BINSTALL_VERSION and BINSTALL_SHA256 in sync; update both together.
-        # To refresh the installer checksum: curl -fsSL "$INSTALLER_URL" | shasum -a 256 | awk '{print $1}'
-        #
-        # If a stronger supply-chain posture is required (similar to cargo-nextest),
-        # extend this step to also verify the checksum of the downloaded cargo-binstall
-        # artefact before invoking it, assuming such checksums are available upstream.
-        # Export so the child installer shell inherits it; the installer reads
-        # BINSTALL_VERSION from the environment to pick the pinned release and
-        # otherwise silently falls back to releases/latest.
-        export BINSTALL_VERSION="v1.19.1"
-        binstall_ver="${BINSTALL_VERSION#v}"
-        # Match the pinned version as a whole, space-delimited token so a
-        # look-alike such as 1.19.10 does not satisfy a 1.19.1 pin. The `-V`
-        # output may be a bare version ("1.19.1") or "<name> <version>".
-        binstall_version_matches() {
-          case " $1 " in
-            *" ${binstall_ver} "*) return 0 ;;
-            *) return 1 ;;
-          esac
-        }
-        if command -v cargo-binstall >/dev/null 2>&1; then
-          existing_version="$(cargo-binstall -V)"
-          if binstall_version_matches "$existing_version"; then
-            echo "cargo-binstall already installed: $existing_version"
-            exit 0
-          fi
-          echo "cargo-binstall version mismatch: expected $binstall_ver, found $existing_version; reinstalling pinned version" >&2
-        fi
-        BINSTALL_SHA256="d3a93702160e0ec03e2a4e996855db1f01adee801fb84a43add24e0877ef8eae"
-        INSTALLER_URL="https://raw.githubusercontent.com/cargo-bins/cargo-binstall/${BINSTALL_VERSION}/install-from-binstall-release.sh"
-        INSTALLER_PATH="$(mktemp)"
-        trap 'rm -f "$INSTALLER_PATH"' EXIT
-        curl -fsSL --proto '=https' --tlsv1.2 "$INSTALLER_URL" -o "$INSTALLER_PATH"
-        if [ ! -s "$INSTALLER_PATH" ]; then
-          echo "cargo-binstall installer download failed or empty" >&2
-          exit 1
-        fi
-        if command -v sha256sum >/dev/null 2>&1; then
-          ACTUAL_SHA256="$(sha256sum "$INSTALLER_PATH" | awk '{print $1}')"
-        else
-          ACTUAL_SHA256="$(shasum -a 256 "$INSTALLER_PATH" | awk '{print $1}')"
-        fi
-        if [ "$ACTUAL_SHA256" != "$BINSTALL_SHA256" ]; then
-          echo "cargo-binstall install script checksum mismatch: $ACTUAL_SHA256" >&2
-          exit 1
-        fi
-        bash "$INSTALLER_PATH"
-        cargo_home_bin="${CARGO_HOME:-$HOME/.cargo}/bin"
-        if [ -n "${GITHUB_PATH:-}" ]; then
-          echo "$cargo_home_bin" >> "$GITHUB_PATH"
-        fi
-        cargo_binstall="$cargo_home_bin/cargo-binstall"
-        installed_version="$("$cargo_binstall" -V)"
-        if ! binstall_version_matches "$installed_version"; then
-          echo "cargo-binstall version verification failed: expected $binstall_ver" >&2
-          printf '%s\n' "$installed_version" >&2
-          exit 1
-        fi
-        echo "cargo-binstall $installed_version verified"
-      shell: bash
     - name: Install cargo-llvm-cov
       if: steps.detect.outputs.lang == 'rust' || steps.detect.outputs.lang == 'mixed'
       run: uv run --script "${{ github.action_path }}/scripts/install_cargo_llvm_cov.py"