Fresh dependency resolution fails: all zip 0.6.x releases yanked #1985

Summary

Every zip 0.6.x release was yanked on crates.io on 2026-10-16. corepc-node 0.12.0, which payjoin-test-utils uses for its download feature, requires zip ^0.6.6, and no corepc-node release has dropped it yet. Any build that resolves dependencies without a lockfile now fails with failed to select a version for the requirement zip = "^0.6.6". Builds that use Cargo-recent.lock or Cargo-minimal.lock still work, because Cargo accepts a yanked version that's already locked.

Three places are broken right now. The DiffMutants and Fuzz jobs in rust.yml never create a Cargo.lock, so both fail on every PR, and contrib/update-lock-files.sh fails on its minimal-versions step, because that step resolves from scratch. The real fix is to bump corepc-node once it releases a version off the yanked zip. Until then, both jobs can copy Cargo-recent.lock to Cargo.lock before building, and the mutants job also needs --in-place, as the weekly mutants job already uses.

Disclosure: This issue was written with Claude Code.