chore(deps): bring every dependency to its latest release with full version pins

[MotherSphere]

Brings the whole dependency tree to its latest releases and writes every requirement as the full version, so the manifest says what the lockfile builds.

Majors

Crate	From	To	What changed in Colony
toml	0.9.11	1.1.8	Nothing: toml::from_str in src/scan.rs is unchanged.
reqwest	0.12.28	0.13.5	Features renamed: rustls-tls is now rustls, and form became opt-in (the OAuth device flow in src/oauth.rs posts forms). default-features = false stays.
dirs	6.0.0	7.0.0	Nothing: the only breaking change is preference_dir on Windows, which Colony does not call.
sha2	0.10.9	0.11.0	digest 0.11 outputs have no LowerHex, so format!("{:x}", ...) no longer compiles. src/download.rs now hex-encodes through one sha256_hex helper, used by the colony.json digest check, the signed-metadata binding and the tests, and checked against the FIPS 180 vectors.
zip	8.6.0	9.0.0	ZipFile::name() is now fallible and returns a Cow. Extraction path checks are unchanged and the zip-slip tests still pass.

Minors and transitive crates came through cargo update (tokio 1.50 to 1.53.2, open 5.4.4, anyhow, serde, serde_json, the wayland, zbus and wasm-bindgen stacks, ...).

Held back on purpose:

• keyring stays on 3 (pinned 3.6.3): the move to 4 is its own change.
• colony-ui stays on 0.1.5: the 0.1.6 bump lands together with the design-system kit adoption.

TLS

reqwest 0.13's rustls feature uses the aws-lc-rs provider and checks certificates through rustls-platform-verifier, i.e. against the OS trust store (Keychain on macOS, the system store on Windows, the CA bundle on Linux) instead of the bundled Mozilla list. Corporate CAs installed on the machine now work; there is still no OpenSSL in the build graph (cargo tree -i openssl-sys --target all -e normal prints nothing), and ring leaves the tree. docs/architecture.md says so.

MSRV

rust-version stays 1.88. Two transitive crates published releases that need more (ordered-float 5.5.0 needs 1.90, uuid 1.27.0 needs 1.89). resolver = "3" makes cargo update MSRV-aware, so it settles on ordered-float 5.4.0 and uuid 1.26.1, and the next cargo update cannot raise the floor by accident. The new majors themselves need at most 1.88 (zip 9).

Manifest and automation

• [package] gains description and repository.
• .github/dependabot.yml is now templates/dependabot.yml from Project-Colony-Resources verbatim: cargo gets allow: dependency-type: all so transitive crates stay current, and the github-actions entry ignores the shared signing workflow, which moves at the organisation pin.
• The sha2 0.11 ignore set on chore(deps): bump sha2 from 0.10.9 to 0.11.0 #45 has been lifted (@dependabot unignore sha2), so 0.11.x patches are proposed again.

Verification

• cargo clippy --locked --all-targets -- -D warnings and cargo test --bin colony locally on Linux.
• cargo metadata: no package in the resolved graph declares a rust-version above 1.88.
• CI covers Windows, macOS, the 1.88 floor and the advisory audit.