feat(plugins): annotation to allow panic

.github/workflows/ci.yml

@@ -171,14 +171,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      # Pinned to match wasm/oxicloud-plugin-hello/rust-toolchain.toml.
+      # Reproducibility of the committed .wasm fixtures depends on both
+      # sides using the same rustc — even a patch bump shifts codegen.
+      # Bump both together.
+      - uses: dtolnay/rust-toolchain@1.96.1
         with:
           targets: wasm32-unknown-unknown
       - uses: Swatinem/rust-cache@v2
       - name: Rebuild committed wasm fixtures
         run: bash scripts/build-plugin-hello.sh
-      - name: Fail if fixtures are stale (rebuild + commit them)
-        run: git diff --exit-code tests/fixtures/plugins/
+      # NOTE: no `git diff --exit-code` staleness check.
+      #
+      # Cross-host wasm builds (contributor aarch64-macOS vs CI
+      # x86_64-linux, same rustc 1.96.1, same `--remap-path-prefix`,
+      # same `CARGO_INCREMENTAL=0`, same profile) still produce
+      # byte-different .wasm — plain `cargo build` doesn't guarantee
+      # bit-reproducible cross-host wasm output. The proper fixes
+      # (containerised builds, or dropping the committed fixtures and
+      # rebuilding from source everywhere) are deferred; the frontend
+      # wasm crate (`wasm/oxicloud-hash`) will hit the same wall when
+      # we add a similar check for it, so we'll tackle both together.
+      # For now: CI rebuilds the fixtures fresh above and uses those
+      # for the plugin runtime tests below. The versions committed at
+      # HEAD are a convenience for local dev without the wasm32
+      # toolchain — they may drift from what CI produces, which is
+      # fine as long as the runtime tests pass.
       - name: Run plugin runtime tests
         # Quote: the trailing `::` confuses GitHub's YAML parser (mapping
         # values not allowed) and aborts the whole workflow at load time.