Unify duplicate windows-sys versions to fix cargo-deny bans check

[unclesp1d3r]

Context

Surfaced during #177 but pre-existing on main and unrelated to MSVC demangling.

cargo deny check bans fails on a duplicate windows-sys:

• 0.59.0 pulled via fs4 -> mmap-guard
• 0.61.2 from the rest of the tree

deny.toml sets multiple-versions = "deny", so this duplicate trips the bans check.

Why this needs its own change

• It is not introduced by any feature work; msvc-demangler adds no new duplicates.
• It must not be masked with a deny.toml skip entry -- a skip would also swallow any genuinely-new windows-sys duplicate a future PR introduces, planting a latent supply-chain hole.
• security.yml (which runs cargo deny) triggers on workflow_run/schedule/workflow_dispatch, not on pull_request, so this failure only shows on scheduled/post-merge runs, not PR status checks.

The fix

Unify windows-sys to a single version by bumping the dependency that pins the old one:

• Investigate whether mmap-guard / fs4 have releases that depend on windows-sys 0.61.x.
• Bump mmap-guard (and/or fs4) accordingly, then confirm cargo deny check bans passes.
• If no compatible upstream release exists yet, track upstream and revisit.

Verify

just deny    # cargo deny check -- bans section must pass
cargo tree -d -i windows-sys   # should show a single version

[coderabbitai]

🔗 Related PRs

#132 - chore(ci): add OSSF and CI best practices [merged]
#134 - fix(security): enforce unsafe code prohibition and update CI requirements [merged]

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!