chore(cargo): enforce 14-day min-publish-age for crates.io deps

[storopoli]

Description

Adds a 14-day cooldown for crates.io dependencies through Cargo's new min-publish-age setting (RFC 3923), in a root .cargo/config.toml:

[unstable]
min-publish-age = true

[registry]
global-min-publish-age = "14 days"

Dependabot already waits 14 days before proposing a bump. This makes plain cargo add, cargo update, and hand-edited version requirements follow the same rule, so a freshly published (and possibly compromised) release can't slip in through a developer's PR. Versions already in Cargo.lock are left alone. For an urgent fix there is a one-off escape hatch:

CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate>

There is no toolchain pin in this repo. On a nightly from 2026-06-21 or later the cooldown is active. On stable, cargo prints a one-line warning and enforces nothing until Rust 1.100 ships on 2026-11-12.

Tracking: STR-3852.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature/Enhancement (non-breaking change which adds functionality or enhances an existing one)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor
• New or updated tests
• Dependency Update

Notes to Reviewers

One gap worth knowing about: versions already in Cargo.lock are exempt by design, so a lockfile produced with the override still passes cargo build --locked in CI. If we want CI to catch that, cargo update --dry-run prints a Downgrading line for every locked version that violates the policy and can be turned into a check. That is out of scope for this PR.

The [unstable] table is temporary. Stable cargo ignores it, and nightly cargo needs it until the feature reaches stable in Rust 1.100 (2026-11-12). After that it can be dropped.

Verified locally with cargo update --dry-run --workspace:

warning: ignoring `registry.global-min-publish-age` without `-Zmin-publish-age`
Locking 0 packages to latest Rust 1.98.0 compatible versions
note: pass `--verbose` to see 58 unchanged dependencies behind latest
warning: not updating lockfile due to dry run

AI disclosure: the change and this PR body were produced with Claude Code and Codex, then reviewed and tested by me.

Is this PR addressing any specification, design doc or external reference document?

• Yes
• No

If yes, please add relevant links:

• https://rust-lang.github.io/rfcs/3923-cargo-min-publish-age.html
• feat(resolver): Stabilize min-publish-age rust-lang/cargo#17335

Checklist

• I have performed a self-review of my code.
• I have commented my code where necessary.
• I have updated the documentation if needed.
• My changes do not introduce new warnings.
• I have added (where necessary) tests that prove my changes are effective or that my feature works.
• New and existing tests pass with my changes.
• I have disclosed my use of AI in the body of this PR.

Related Issues

STR-3852

[github-actions]

🔒 AI Security Review (claude-opus-5)

✅ No security issues found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f1c508342a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

🔒 AI Security Review (claude-opus-5)

✅ No security issues found.