deps(cargo): lock compatible patch/minor bumps

[rearden-grok]

Summary

cargo update on current master after a changelog + publisher + RustSec review. Lock-only (plus CHANGELOG). Direct Cargo.toml crates were already at latest compatible.

Security review

Scanned the lock against RustSec advisory-db (clone 2026-08-25). Historical hits (bytes RUSTSEC-2026-0007, rand RUSTSEC-2026-0097, tokio RUSTSEC-2025-0023, slab RUSTSEC-2025-0047, ruzstd RUSTSEC-2024-0400, tungstenite RUSTSEC-2023-0065, plus older hyper/http/mio/shlex/zerocopy/…) are already in patched ranges. No unpatched advisory on this graph.

Aug 2026 proc-macro1 / arrayref dropper: none of those crates are in the lock. Taken bumps are from long-standing owners (apoelstra, dtolnay, dhardy, joshlf, KodrAus, seanmonstar, taiki-e) or GitHub Trusted Publishing (rust-lang/cc-rs, rust-random/rand). No new required deps, no new build.rs crates, licenses unchanged (cargo deny check advisories/bans/licenses/sources ok).

Taken (compatible cargo update)

Crate	From → to	What changed	Why ok
bitcoin-consensus-encoding	1.1.0 → 1.2.0	Expose low-level encoder/decoder drivers, docs, looser serde bounds, flatten error constructors (changelog). Published by apoelstra. Hex/serde still optional.	Minor 1.x; no compact-size/consensus decode behavior change. Transitive only.
cc	1.4.0 → 1.4.4	Honour Build::env in Android llvm-ar / flag probes; NEON vs VFPv4; frame-pointer CFLAGS; MSRV 1.65. Trusted Publishing rust-lang/cc-rs.	Build-time only (secp256k1-sys). Probe/env honoring, not a new compiler invocation path.
find-msvc-tools	0.1.9 → 0.1.11	MSRV 1.65 + edition 2021. Same Trusted Publishing repo.	Windows MSVC discovery only; no logic change.
futures-channel	0.3.33 → 0.3.34	Preserve cloned waker identity (#3032); syn 3. Matches already-locked futures-util 0.3.34. taiki-e.	Aligns the 0.3.34 futures family; waker-identity fix is correctness.
http-body-util	0.1.4 → 0.1.5	Docs: doc_auto_cfg → doc_cfg (2 commits). seanmonstar. Same deps.	Docs-only.
log	0.4.33 → 0.4.34	README + alloc boxed loggers. KodrAus.	We do not use log’s boxed logger path (rbitcoin-log).
rand	0.8.7 → 0.8.8	Fix --no-default-features --features serde1 (#1825). dhardy; Trusted Publishing rust-random/rand (sha 572d3b0). 3 commits.	Compile fix only. RUSTSEC-2026-0097 already patched >= 0.8.6. Used via secp256k1 0.29.
syn	3.0.3 → 3.0.4	Allow safe fn in ForeignItemFn parse (#2078). dtolnay GPG-signed tag.	Parser fix; proc-macro 3.x (zerocopy-derive). syn 2.0.119 stays for the rest.
zerocopy / zerocopy-derive	0.8.55 → 0.8.56	Drop obsolete dep pin, authors field, kani extern crate alloc, crate = path parse. joshlf / google/zerocopy.	No change to the unsafe transmute core. RUSTSEC-2023-0074 already patched >= 0.7.31.

Deliberately skipped

Crate	Available	Why not
bitcoin_hashes	0.14.101 → 1.2.0	Policy: co-bump with bitcoin / bip324 only (.github/dependabot.yml, docs/reproducible-builds.md).
tokio-tungstenite / tungstenite	0.29.0 → 0.30.0	0.x minor is breaking. Esplora test dep is pinned to match axum 0.8’s 0.29 line. Bumping would dual-graph.
matchit 0.8.6, generic-array 0.14.9	parent exact/range pins	cargo update left them (axum / digest).
chacha20-poly1305 0.2, libc 1.0-alpha, rand 0.9→0.10	breaking / pre-release	Already have rand 0.8+0.9; libc 1.0 is alpha.
nixpkgs / crane / Actions	monthly / weekly Dependabot	Out of this cargo lock PR.

Direct crates already current: serde 1.0.229, serde_json 1.0.151, axum 0.8.9, tower 0.5.3, tower-http 0.7.0, bitcoin 0.32.102, bip324 0.11.0, tokio 1.53.1, arc-swap 1.9.2, mimalloc 0.1.52, ruzstd 0.9.0, io-uring 0.7.14, libc 0.2.189, getrandom 0.4.3, base64 0.23.1, http 1.5.0, hyper 1.11.0.

Verify

• cargo deny check — advisories/bans/licenses/sources ok
• cargo check -p rbitcoin-consensus -p rbitcoin-esplora -p rbitcoin-store -p rbitcoin-net

Not merged; CI must go green.