chore(deps): bump deps past semver-major and pin author digests

.github/workflows/ci.yml

@@ -4,6 +4,16 @@ on:
   push:
     branches: [main]
   pull_request:
+  # Manual re-run, matching every other workflow in this directory. The
+  # `coverage` job is the reason: Codecov compares a PR against the most
+  # recent *ancestor that has a report*, so a push to main that produces
+  # no run leaves every later PR silently baselined against an older
+  # commit — the diff table then attributes those intervening commits'
+  # coverage to whichever PR is open. That happened at d818e306, which
+  # carries zero check-runs, and left PR #1223 compared against a base
+  # eight commits behind. Without a dispatch trigger the only remedy is
+  # to land another commit on main.
+  workflow_dispatch:
 
 # Default to read-only; jobs that need more escalate explicitly.
 permissions:

CHANGELOG.md

@@ -183,6 +183,37 @@ for historical reference.
 
 ### Changed
 
+- Dependencies advanced past the semver-major line Dependabot is
+  configured to ignore: `gix` 0.83 → 0.86, `sha2` 0.10.9 → 0.11.0,
+  `hmac` 0.12.1 → 0.13.0, `num-derive` 0.4 → 0.5, `clap_mangen` 0.2 →
+  0.3, and `jsonschema` 0.46 → 0.49 (dev only), alongside a full
+  lockfile refresh in the root workspace and in each of the six
+  excluded crates. No behaviour change and no public-API change — no
+  `gix` or RustCrypto type appears in a public signature, so
+  `STABILITY.md` is unaffected. Two consequences are worth recording.
+  `sha2` and `hmac` now sit on the RustCrypto `digest` 0.11 trait
+  family, which `actix-http` already pulled in via `sha1` 0.11. Only
+  the trait plumbing moved, so every emitted digest is byte-identical:
+  the Code Climate fingerprints were already pinned to literal values,
+  and the author-identity digests are pinned for the first time by the
+  entry below. And `clap_mangen` 0.3 renders a required option after
+  the optional ones in the SYNOPSIS, which moves `<-t|--type>` in
+  `man/bca-count.1` and `man/bca-find.1`.
+
+- `AuthorId::hashed` and `AuthorHashKey::apply` are now pinned to
+  absolute digest values, derived independently from Python's
+  `hashlib` / `hmac` so the assertions check conformance to SHA-256 and
+  RFC 2104 rather than agreement with our own implementation. Every
+  prior assertion on these two was relational — comparing one digest
+  against another produced by the same build — and so held whatever the
+  hash library emitted. That is the wrong shape for a *stored* value:
+  `src/vcs/cache.rs` writes unkeyed digests to disk and honours them
+  across version boundaries (`CACHE_SCHEMA_VERSION` tracks the on-disk
+  format, not the hash implementation), and `AuthorId::hashed`
+  documents the emitted digests as stable cross-report pseudonyms.
+  Perturbing either pre-image fails the two new tests and nothing
+  else, which is what the gap looked like from the inside.
+
 - Severity prefixes moved off the message producers and onto the layer
   that presents them (#609, #1199). `PreprocDiagnostic`'s `Display` now
   renders the **bare message, with no severity prefix at all**: `bca