fix(deps): clear cargo deny's advisories, so a release commit passes #799

cargo deny check advisories failed on main, which stopped the chore(release) commit that scripts/release.sh makes, since that commit always touches Cargo.lock. Two new advisories, plus a stale ignore:

• RUSTSEC-2026-0386 (tokio, unsound AsyncFd constructors): tokio moves from 1.53.1 to 1.54.1 (rust-version 1.85, inside the 1.90 MSRV). The lockfile diff also re-points a few dependency edges at versions that were already locked: windows-sys for Windows-only edges, and syn 2 instead of 3 for data-encoding-macro-internal. Cargo 1.99 picks these on any update, and main's lockfile is valid either way.
• RUSTSEC-2026-0387 (crypto-bigint 0.5.5, timing leaks in operations meant to be constant-time): the only fix is 0.7.6, behind elliptic-curve 0.14. atproto-identity 0.14.5, the newest, pins elliptic-curve, p256, k256, p384 and ecdsa to 0.13, so there is nothing to update to yet. It is ignored in deny.toml, with the exposure written down: the one secret key in the workspace is the CLI's DPoP proof key, signing on its own user's machine, and the index and query services only verify signatures over public data. The ignore should go once atproto-identity moves to elliptic-curve 0.14.
• RUSTSEC-2026-0381: this ignore matched nothing any more, and cargo-deny warned about it, so it's removed.

cargo deny check advisories now reports advisories ok. cargo check --workspace --all-targets --locked passes, and so do all 162 CLI tests.

🤖 Generated with Claude Code