deps: refresh Rust dependencies and repair compatibility checks

[dependabot]

Refresh nine Rust dependencies and their locked transitive packages. This also repairs the issues exposed while reviewing the update:

• Replace yanked chacha20 0.10.0 with RustCrypto's 0.10.2 patch so Cargo Deny passes.
• Declare Rust 1.90, required by ordered-float 5.5.0, and update installation documentation. The previous 1.77 claim was already incompatible with the dependency graph; its CI job silently ran Rust 1.92 from rust-toolchain.toml.
• Make MSRV and stable/beta CI jobs explicitly select their compilers, report the active compiler, and use the lockfile. Align the book's development toolchain with the root's 1.92.0 pin.
• Adapt two divisibility expressions for Clippy while preserving the alignment helper's zero-alignment panic. Disable Cargo Deny matrix fail-fast so both policy results are reported.

No feature flags changed. Added Unreleased changelog entries targeting 0.5.8; this PR does not publish a release.

Dependency	Previous	Updated
zerocopy	0.8.55	0.8.56
rkyv	0.8.17	0.8.18
thiserror	2.0.19	2.0.20
ordered-float	5.3.0	5.5.0
glam	0.33.2	0.33.6
crc32fast	1.5.0	1.5.1
clap	4.6.5	4.6.6
wgpu	30.0.0	30.0.1
cudarc	0.19.8	0.19.9
chacha20 (transitive)	0.10.0 (yanked)	0.10.2

Validation: safer local test wrapper (149 tests and 22 doctests; known slow ESDF test excluded), actual Rust 1.90 all-features check, CI-equivalent Clippy, rustfmt, book-quality checks, and Cargo Deny bans/licenses/sources. A fresh cargo audit found no vulnerabilities, with only the existing acknowledged paste unmaintained warning. Local cargo-deny 0.18.5 cannot parse current CVSS 4.0 advisories; the advisory gate must pass with CI's maintained cargo-deny version before merge.

Sources: RustCrypto fix, ordered-float 5.5.0 release, rustup override precedence.

[FunKite]

Reviewed PR #172 at db6bbea0f695262c3ac3f444fe99627f55177129, including the full diff, release notes, reviews, comments, and review threads (none outstanding).

Found and am fixing three issues in this PR:

• Cargo Deny rejects the existing yanked chacha20 0.10.0 pulled in by rand. Updated precisely to 0.10.2, the RustCrypto patch correcting SSE4.1 instructions in the SSE2 RNG backend. No new dependency names or registries were introduced.
• ordered-float 5.5.0 requires Rust 1.90. The existing Rust 1.77 claim was already incompatible with dependencies such as wgpu, and the old MSRV job actually ran the repository-pinned Rust 1.92. Updated the declared MSRV and installation guidance to 1.90 and made the MSRV and stable/beta jobs explicitly select their compilers and use the lockfile.
• The bans/licenses/sources check completed successfully but was marked cancelled when the advisory matrix job failed. Disabled matrix fail-fast so both security results remain visible. Existing deny policies and advisory exceptions are unchanged.

Added the required Unreleased changelog entries for the next maintenance release, 0.5.8. Local safe validation passed 149 tests and 22 doctests (the wrapper excludes the known slow ESDF test); formatting and book-quality checks passed. Testing the actual Rust 1.90 all-features build and refreshing the security audit now. I will push these fixes and wait for checks on the new head before approval and merge.

Maintenance lesson: installing a compiler does not prove the subsequent Cargo command uses it; rust-toolchain.toml can override the default. The explicit CI toolchain selection and compiler-version output now make this verifiable.

[FunKite]

Pushed fixes in 3a2b5fdf7d9e604aa808f858f69448fdacd5a135:

• Yanked chacha20: fixed by the precise 0.10.2 lockfile update.
• Incorrect MSRV / overridden compiler checks: fixed in the manifest, CI, and installation docs; the actual Rust 1.90 all-features check passes locally.
• Cancelled security-matrix result: fixed with fail-fast: false.
• Clippy warnings exposed by the corrected MSRV: fixed using is_multiple_of, preserving the existing zero-alignment panic.
• Required changelog: added all dependency, compatibility, and workflow changes under Unreleased.

Final local validation passed: 149 tests, 22 doctests, Rust 1.90 all-features check, CI-equivalent Clippy, formatting, book quality, and Cargo Deny bans/licenses/sources. A fresh cargo-audit scan loaded 1,239 advisories and found no vulnerabilities; only the already-acknowledged paste warning remains. Local cargo-deny 0.18.5 cannot parse CVSS 4.0, so the current CI Cargo Deny advisory job is still required.

GitHub is running the new head's Rust CI, Security, Book Quality, and CodeQL checks. Merge is waiting for those results and final review; no branch protection bypass is being used.

[FunKite]

Reviewed final head 3a2b5fdf7d9e604aa808f858f69448fdacd5a135 and the full PR conversation; no unresolved findings or review threads remain. All 26 GitHub checks pass, including all 14 required checks, both Cargo Deny gates, both security audits, GPU backends, the cross-platform tests, and CodeQL.

Verified the repaired CI jobs actually ran Rust 1.90.0 (MSRV), 1.98.1 (stable), and 1.99.0-beta.3. Local tests, doctests, MSRV all-features build, Clippy, formatting, and book checks passed. The yanked chacha20 dependency is fixed at 0.10.2; no new dependencies or registry sources were added. Current Dependabot and code-scanning alert lists are empty. The existing paste maintenance warning remains documented.

The manifest and docs now accurately require Rust 1.90. Approved for squash merge.