build: avoid wasm toolchain network resync

Author: a19q3

CHANGELOG.md

@@ -8,7 +8,9 @@
   to every gate. The policy traverses initialized submodules and rejects
   retired interpreter sources, generated bytecode/cache artifacts, capture
   logs, and active tooling references before they can re-enter the release
-  contract.
+  contract. The canonical WASM container now explicitly selects its already
+  installed pinned Rust toolchain, avoiding an unnecessary network sync during
+  release builds.
 - Restore the 0.23 release gate after the Python-to-Rust tooling migration by
   checking the semantic `requires_all_bundled_examples_strict_original_ckb`
   and emitted `source_provenance` CKB boundaries plus the Rust-backed NovaSeal