fix: upgrade Octocrab within the declared MSRV

[pierrick-fonquerne]

Summary

• upgrade Octocrab from 0.44.1 to 0.47.1 with only the GitHub client, Rustls, and timeout features
• configure Cargo dependency updates to prefer versions compatible with the declared Rust 1.88 MSRV
• document why 0.47.1 is the newest safe and fleet-portable target
• update quinn-proto to 0.11.16 to remove RUSTSEC-2026-0185
• add a policy test that protects the resolver and feature choices

Root cause

Dependabot PR #32 proposed Octocrab 0.54.1. Its build dependency chain selected cargo-platform 0.3.3, which requires Rust 1.91, while this repository declares and tests Rust 1.88.

Cargo's MSRV-aware fallback can select the compatible cargo-platform 0.3.2, but Octocrab 0.48+ also requires a JWT crypto backend that this workflow-token client does not use. The RustCrypto option introduces the unpatched RUSTSEC-2023-0071 advisory; the AWS-LC option requires an extra native toolchain and fails on a clean Windows host without NASM. Octocrab 0.47.1 avoids both problems and supports Rust 1.73.

The broader fleet MSRV decision remains tracked in #28.

Validation

• cargo +1.88.0 fmt --all -- --check
• cargo +1.88.0 clippy --workspace --all-targets --all-features -- -D warnings
• cargo +1.88.0 test --workspace --all-features --no-fail-fast (72 tests)
• cargo +1.88.0 check --workspace --all-features --all-targets
• cargo +1.88.0 update -p octocrab (0 packages changed)
• cargo audit (0 vulnerabilities)
• git diff --check

Closes #29.

Supersedes #32 once merged.

[pierrick-fonquerne]

Final review: no findings.

Validated the exact head SHA 0e945bbf8167db754557aa450306bc7f3eacb0ce with the Rust 1.88 format, Clippy, test, check, resolver-stability, and audit commands documented in the PR. All four GitHub CI jobs passed. The end-to-end smoke test in nubster-opensources/lightshuttle#318 also passed both reusable jobs and successfully published the team review comment through the upgraded Octocrab client.