Pin zerocopy to 0.8.59 in the cargo-kani tests that depend on rand

[feliperodri]

The required regression check currently fails on every PR, and on main's nightly runs, in three cargo-kani tests: cbmc-unknown-lang-mode, dependencies and stubbing-validate-random. The cause is a zerocopy release, not Kani (#4988).

zerocopy 0.8.60, released 2026-10-05, added a #[cfg(any(test, kani))] module that uses #[derive(KnownLayout)]. That derive only exists with zerocopy's derive feature. Kani compiles dependencies with --cfg kani, so the module gets built without the feature and fails. These three tests depend on rand 0.8, which pulls in zerocopy through ppv-lite86. The test projects have no lockfile, so they picked up 0.8.60 as soon as it was published.

This PR adds zerocopy = "=0.8.59" to the three tests' Cargo.toml, with a comment pointing at #4988. Cargo has to resolve the whole tree to that version, and nothing else is pinned. It's a stopgap: once zerocopy publishes a fixed release, revert this.

Testing. The cargo-kani suite passes locally on main with this change (71 of 71). Before it, those three tests fail with cannot find derive macro KnownLayout. In a one-dependency crate on Kani main, zerocopy = "=0.8.60" fails and =0.8.59 verifies.

For reviewers. The alternative is to enable zerocopy's derive feature in these tests, which also compiles. I went with the pin because it keeps the tests on the exact dependency code they had before 2026-10-05.

Towards #4988 (the issue stays open until zerocopy is fixed and the pin removed).

[Copilot]

Copilot review overview

🟢 Approval recommended

The targeted pins consistently address the documented upstream regression without unrelated changes.

Review effort: Balanced
Findings: None

What changed in this PR

Pins zerocopy to 0.8.59 in three isolated cargo-kani test projects, restoring CI while upstream issue #4988 remains unresolved.

Changes:

• Adds the temporary exact dependency pin.
• Documents the failure and removal condition.

File	Description
tests/​cargo-kani/​stubbing-validate-random/​Cargo.toml	Pins zerocopy for the rand-based test.
tests/​cargo-kani/​dependencies/​Cargo.toml	Pins zerocopy for dependency verification.
tests/​cargo-kani/​cbmc-unknown-lang-mode/​Cargo.toml	Pins zerocopy for the language-mode test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[feliperodri]

Closing: zerocopy fixed this upstream in 0.8.61 (google/zerocopy#3792), and these tests now resolve to 0.8.62 and pass without a pin. I checked the three tests on the toolchain-bump branch (#4987) with no pin: all pass.