fix(ci): unbreak clippy on Rust 1.97 and pin the toolchain

CI has been red on main since Jul 18. Root cause: there is no toolchain pin,
so CI floats to the newest stable. Rust 1.97.0 landed 2026-07-09 with a
stricter clippy::for_kv_map and started failing patterns.rs:452, a line that
has been in the tree since the v1.0.0 initial commit. The last green CI run on
main was Jul 9, the same day 1.97.0 shipped.

- patterns.rs: iter_mut() -> values_mut() in delete_pattern
- add rust-toolchain.toml pinning 1.97.1 with clippy and rustfmt, so a future
  Rust release cannot turn main red with no code change

Verified on 1.97.1: cargo test --workspace 1588 passed / 0 failed,
cargo clippy --workspace --all-targets -- -D warnings exit 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/vestige-core/src/codebase/patterns.rs

@@ -449,7 +449,7 @@ impl PatternDetector {
     pub fn delete_pattern(&mut self, pattern_id: &str) -> Result<()> {
         if self.patterns.remove(pattern_id).is_some() {
             // Clean up indexes
-            for (_, ids) in self.patterns_by_language.iter_mut() {
+            for ids in self.patterns_by_language.values_mut() {
                 ids.retain(|id| id != pattern_id);
             }
             self.pattern_keywords.remove(pattern_id);

rust-toolchain.toml

@@ -0,0 +1,11 @@
+# Pin the toolchain so CI, release builds, and contributors all compile and lint
+# against the same Rust. Without this, CI floats to whatever stable is newest and
+# a Rust release can turn main red with no code change: 1.97.0 landed on 2026-07-09
+# with a stricter `clippy::for_kv_map` and broke CI on a line that had been in the
+# tree since v1.0.0.
+#
+# Bump this deliberately, and run `cargo clippy --workspace --all-targets -- -D warnings`
+# when you do.
+[toolchain]
+channel = "1.97.1"
+components = ["rustfmt", "clippy"]