chore(deps): update all dependencies to latest

[bryantbiggs]

Regenerates every lockfile from scratch and bumps manifests and pins to latest, including majors. The Rust workspace was already tracking the newest major of every crate, so its only manifest change is a floor bump; the rest is a full Cargo.lock refresh to the latest compatible versions.

• astro 6.4.8 → 7.1.3
• @astrojs/markdown-remark → 7.2.1 (new direct dependency, see below)
• google-cloud-auth 1.13 → 1.14
• terraform-aws-modules/key-pair/aws ~> 2.0 → ~> 3.0
• actions/checkout v7.0.0 → v7.0.1
• actions/setup-go v6.4.0 → v7.0.0
• actions/setup-node v6.4.0 → v7.0.0
• actions/cache v5.0.5 → v6.1.0
• dorny/paths-filter v4.0.1 → v4.0.2
• EmbarkStudios/cargo-deny-action v2.0.20 → v2.1.1
• aws-actions/configure-aws-credentials v6.2.0 → v6.2.2
• actions/attest-build-provenance v4.1.0 → v4.1.1
• softprops/action-gh-release v3.0.1 → v3.0.2
• dtolnay/rust-toolchain — master pin refreshed to the latest commit

Astro 7 moved @astrojs/markdown-remark from a direct dependency to a peer-only one pinned at exactly 7.2.1, which npm no longer installs automatically. docs/astro.config.mjs imports it directly (import { unified } from "@astrojs/markdown-remark"), so it is now declared as a direct dependency at astro's exact peer version. No changes were needed in astro.config.mjs or plugins/rewrite-internal-links.mjs; the production build and the custom link-rewrite and autolink pipeline both pass.

The Cargo.lock refresh moved serde_derive, clap_derive, schemars, and async-trait onto the new syn 3.0 major while async-stream and the aws-smithy proc-macros stay on syn 2, an unavoidable transitive split. deny.toml gains a syn@2 skip to cover it and drops the getrandom@0.3 and r-efi@5 skips, which no longer match any duplicate. Notable transitive bumps include aws-lc-fips-sys 0.13.14 → 0.13.16 (same frozen FIPS branch, still built with gcc-13 in the Docker image), the AWS SDK crates, tokio 1.52 → 1.53, reqwest 0.13.4, and serde 1.0.229.

Supersedes #109.