fix(vm): isolate baseline builds from candidate warning flags

Author: jdx

harness/vm/README.md

@@ -28,3 +28,5 @@ space plus compilation caches. Keys and repositories are generated test fixtures
 no production signing key is used. CI uploads logs and binary identities, not the
 disk image or fixture private keys. This exercises package lifecycle and boot
 persistence, not an Omarchy desktop session or full distro upgrade matrix.
+
+Baseline source builds clear inherited `RUSTFLAGS` and `CARGO_ENCODED_RUSTFLAGS`, so current CI warning policy does not reject an older release merely because rustc gained a new lint. Candidate builds retain the workflow flags.

harness/vm/run

@@ -47,7 +47,7 @@ else
 	baseline_sha=$(git rev-parse --verify --end-of-options "$baseline_ref^{commit}")
 	baseline_checkout="$work/baseline"
 	git worktree add --detach "$baseline_checkout" "$baseline_sha"
-	(cd "$baseline_checkout" && CARGO_TARGET_DIR="$repo/target/vm-baseline" cargo build --locked -p pacvamp)
+	(cd "$baseline_checkout" && env -u RUSTFLAGS -u CARGO_ENCODED_RUSTFLAGS CARGO_TARGET_DIR="$repo/target/vm-baseline" cargo build --locked -p pacvamp)
 	cp "$repo/target/vm-baseline/debug/pacvamp" "$work/previous"
 fi
 python3 - "$work" "$report" "$baseline_ref" "$baseline_sha" <<'PY'