fix(deps): resolve RUSTSEC advisories in lru, anyhow and error-stack

[dduugg]

Resolves the three open RUSTSEC advisories from the triage board. Kept as one PR because
both halves touch Cargo.lock; splitting them would have guaranteed a merge conflict between
the two. The two commits are independently reviewable:

1. fix(deps): drop unused lru feature and bump anyhow (deps only, no code change)

RUSTSEC-2026-0253 — lru 0.7.8, use-after-free in LruCache::pop() (#117).
lru reaches us through memoize's default full feature (full = ["lru", "memoize-inner/full"]).
The advisory is only fixed in lru >= 0.18.2, but memoize — including its latest release,
0.6.0 — still requires lru ^0.7, so no lockfile can resolve a patched version while that
feature is on. We only ever use bare #[memoize], never the Capacity/TimeToLive options
that need lru, so building memoize with default-features = false removes the crate from
the graph entirely instead of suppressing the advisory. Also drops ahash 0.7, getrandom 0.2,
version_check and wasi 0.11.

RUSTSEC-2026-0190 — anyhow 1.0.83, unsoundness in Error::downcast_mut() (#114).
anyhow is an optional, non-activated dependency of error-stack that still gets resolved
into Cargo.lock (and so still gets flagged). cargo update -p anyhow takes it to 1.0.104,
past the >= 1.0.103 patch line.

2. fix(deps): upgrade error-stack to 0.8.0 (#115)

RUSTSEC-2026-0198 — Report::frames_mut handed out &mut Frames with lifetimes independent
of the iterator, so a frame and one of its sources could be borrowed mutably at the same time.
We never call frames_mut, but 0.8.0 is the only patched release, and getting there means
crossing the 0.6/0.7 API breaks:

removed / renamed	in	replacement here
Context trait	0.7	impl core::error::Error (3 types)
Result<T, C> alias	0.8	Result<T, Report<C>>
report!	0.7	Report::new
attach_printable / attach_printable_lazy	0.6	attach / attach_with

Two notes on why these are behaviour-preserving rather than merely compiling:

• core::error::Error is exactly the bound Report::new/change_context require, and its
  default source() returns None, so no new frames appear in any report.
• 0.6 also renamed the old attach to attach_opaque. That's the dangerous half of the
  rename, because an attachment that becomes opaque silently disappears from rendered output.
  This crate had no plain attach calls, so every rename here is the printable variant.

Result<T, Report<C>> is the same type the deleted alias expanded to, so the public signatures
in src/runner/api.rs are unchanged for consumers.

Verification

• cargo audit (real cargo-audit, 1217 advisories loaded): zero advisories, down from three.
• cargo fmt --check, RUSTFLAGS=-Dwarnings cargo clippy --all-targets --all-features,
  cargo test (148 passing) all green.
• cargo build --release --target aarch64-apple-darwin --target x86_64-apple-darwin — the
  release job's exact command — succeeds.
• Rendered stderr is byte-identical before and after the error-stack upgrade across five
  distinct failure paths, including a four-level nested report with attachments
  (diff of the two captures is empty).
• error-stack 0.8.0's MSRV is 1.83, under the 1.89.0 pin in rust-toolchain.toml.

Not included

No version bump — version stays at 0.3.4, so merging this does not cut a release
(check_for_version_changes evaluates changed=false; verified the added
memoize = { version = ... } line does not false-positive that job's grep "\+version").
Worth noting that downstream Rust consumers of the published crate only pick up the
error-stack fix once a release goes out, and main already carries unreleased #111–#113,
so a release PR is a separate decision.

Closes #114
Closes #115
Closes #117