feat(server,deps,ci): update deps, fix CI scoping, panic exit, crash recovery

.github/actions/rust/pre-merge/action.yml

@@ -92,11 +92,14 @@ runs:
       run: git fetch origin master --depth=1 2>/dev/null || true
       shell: bash
 
+    # Pinned: 0.24 dropped `-f json` and 0.25 retired `[change-detection]` in
+    # rail.toml. Either failure falls back to the full test suite on every PR,
+    # so bump on purpose together with `cargo rail config migrate`.
     - name: Install cargo-rail
       if: startsWith(inputs.task, 'test-') && inputs.task != 'test-storage-compat'
       uses: taiki-e/install-action@v2
       with:
-        tool: cargo-rail
+        tool: cargo-rail@0.23.0
 
     - name: Compute affected crates (cargo-rail)
       if: startsWith(inputs.task, 'test-') && inputs.task != 'test-storage-compat'
@@ -293,32 +296,45 @@ runs:
 
         # api_handler_tests, version_firewall_tests, and server_e2e_tests need gitignored
         # wire fixtures. Generate when iggy-gateway-kafka is in the DAG test scope, or (on
-        # a full-workspace run) when gateways/** changed vs origin/master — avoid building
+        # a full-workspace run) when gateways/** changed vs the PR base — avoid building
         # kafka-message-gen / kafka-protocol when the gateway was not touched.
         NEEDS_KAFKA_FIXTURES=false
         if grep -q 'package(iggy-gateway-kafka)' <<< "$NEXTEST_FILTER"; then
           NEEDS_KAFKA_FIXTURES=true
         elif [[ -z "$NEXTEST_FILTER" ]]; then
+          # HEAD on a pull_request run is the synthetic merge commit; its first parent is
+          # the base tip GitHub merged against. The depth-1 checkout holds that parent only
+          # as a shallow boundary: `HEAD^1` does not resolve and `origin/master...HEAD` has
+          # no merge base (so it failed on every full-workspace lane). Read the parent from
+          # the raw object and fetch that one commit before diffing. A HEAD with one parent
+          # (workflow_dispatch on a branch tip) has no PR base, so it takes the fail-safe.
+          #
           # `2>&1` into a variable, not `2>/dev/null` piped straight to grep: the old form
-          # silenced *any* git failure (e.g. a shallow checkout with no merge-base history for
-          # origin/master) into empty output, which `grep -q` then reads identically to "diff
-          # succeeded, no gateways/ changes" - so a broken diff and a clean diff produced the
-          # same "skip fixtures" outcome. Confirmed in CI run 32256598833: gateways/-only PR,
-          # full-workspace lane, fixtures silently skipped, KAFKA_FIXTURES_REQUIRED never set -
-          # every fixture-backed test quietly passed by skipping all its assertions instead of
-          # running them (0.005s for a test meant to decode 9 real fixtures).
-          if DIFF_OUTPUT=$(git diff --name-only origin/master...HEAD 2>&1); then
+          # silenced *any* git failure into empty output, which `grep -q` then reads
+          # identically to "diff succeeded, no gateways/ changes" - so a broken diff and a
+          # clean diff produced the same "skip fixtures" outcome. Confirmed in CI run
+          # 32256598833: gateways/-only PR, full-workspace lane, fixtures silently skipped,
+          # KAFKA_FIXTURES_REQUIRED never set - every fixture-backed test quietly passed by
+          # skipping all its assertions instead of running them (0.005s for a test meant to
+          # decode 9 real fixtures).
+          BASE_SHA=""
+          if [[ "$(git cat-file -p HEAD | grep -c '^parent ')" -eq 2 ]]; then
+            BASE_SHA=$(git cat-file -p HEAD | awk '/^parent /{print $2; exit}')
+          fi
+          if [[ -n "$BASE_SHA" ]] \
+            && DIFF_OUTPUT=$(git fetch -q --no-tags --depth=1 origin "$BASE_SHA" 2>&1 \
+              && git diff --name-only "$BASE_SHA" HEAD 2>&1); then
             if grep -qE '^gateways/' <<< "$DIFF_OUTPUT"; then
               NEEDS_KAFKA_FIXTURES=true
             else
               echo "::notice::Skipping Kafka wire fixtures (full suite, gateways/** unchanged)"
             fi
           else
-            # Diff itself failed - NOT the same as "no gateways/ changes". Generate
-            # unconditionally as the fail-safe default; this is the case the bug above collapsed
-            # into a silent skip.
+            # No PR base, or fetch/diff failed - NOT the same as "no gateways/ changes".
+            # Generate unconditionally as the fail-safe default; this is the case the bug
+            # above collapsed into a silent skip.
             NEEDS_KAFKA_FIXTURES=true
-            echo "::warning::git diff origin/master...HEAD failed (${DIFF_OUTPUT}); generating Kafka fixtures unconditionally as a fail-safe"
+            echo "::warning::git diff against the PR base failed (base: ${BASE_SHA:-none, HEAD is not a merge commit}; ${DIFF_OUTPUT:-}); generating Kafka fixtures unconditionally as a fail-safe"
           fi
         fi
         if [[ "$NEEDS_KAFKA_FIXTURES" == true ]]; then

.github/config/hawkeye.version

@@ -1 +1 @@
-7.0.0
+7.0.1

.github/workflows/post-merge.yml

@@ -64,10 +64,12 @@ jobs:
       # Metadata-only `cargo rail plan` (no compile), so it runs on the runner's
       # preinstalled cargo (version pinned by rust-toolchain.toml) and skips the
       # heavyweight build-cache restore.
+      # Pinned for the same reason as .github/actions/rust/pre-merge/action.yml:
+      # 0.24 dropped the `-f json` edge-affected-images.sh relies on.
       - name: Install cargo-rail
         uses: taiki-e/install-action@v2.86.7
         with:
-          tool: cargo-rail
+          tool: cargo-rail@0.23.0
 
       - name: Check all components
         id: check