build: fix cargo-audit/cargo-deny CI drift (yanked spin, quick-xml advisories, MSRV)

[UnbreakableMJ]

Summary

Unrelated CI/dependency drift discovered while opening #49, blocking merge for reasons that have nothing to do with that PR's diff:

• cargo deny check failed: spin 0.9.8 (transitive via wiremock/deadpool/lazy_static, dev-only) was yanked upstream. Bumped to 0.9.9.
• cargo-audit's own install broke in CI: rustsec/audit-check@v2 runs a bare cargo install cargo-audit, which re-resolves cargo-audit's own dependencies fresh every run — a transitive kstring bump now requires a newer rustc than the workspace's pinned 1.95.0. Replaced the action with a manual cargo install cargo-audit --locked (pins to cargo-audit's own committed lockfile) + a plain cargo audit step, mirroring just audit and dropping the now-unused checks: write permission.
• A fresh cargo audit/cargo deny run also surfaced two new advisories: RUSTSEC-2026-0195 / RUSTSEC-2026-0194 (quick-xml 0.39.4, build-time-only proc-macro dep of wayland-scanner, transitive via arboard's Wayland clipboard support — no newer wayland-scanner resolvable yet under wayland-client's current constraint). Added to the ignore list in CI + deny.toml + justfile, matching the existing paste/rsa rationale comments. Bumped anyhow 1.0.102 → 1.0.104 in passing, clearing RUSTSEC-2026-0190.

Test plan

• cargo build --workspace
• cargo test --workspace --all-targets — all green
• cargo fmt --all -- --check
• cargo deny check — advisories/bans/licenses/sources all ok
• cargo audit --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0002 --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2026-0195 --ignore RUSTSEC-2026-0194 — clean
• reuse lint — compliant

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.