fix: unbreak main CI after the rust 1.98 toolchain bump

[henry40408]

Both jobs on main went red after #95 merged. This fixes each one.

image (Docker) — regression from #95

rustc 1.98 emits -Wl,--fix-cortex-a53-843419 for aarch64 targets (rust-lang/rust#155453). zig's linker rejects it, so the arm64 leg fails outright:

error: linking with `.../zigcc-aarch64-unknown-linux-musl-5d3b.sh` failed: exit status: 1
  = note: error: unsupported linker arg: --fix-cortex-a53-843419
error: could not compile `lur` (bin "lur") due to 1 previous error

cargo-zigbuild 0.23.0 filters that argument out before invoking zig (src/zig.rs, citing the same rustc PR). It is the oldest release with the fix and was published 2026-06-18, so it clears the 7-day publish cooldown — 0.23.2 and 0.23.3 do not. 0.23.0 still branches on the zig version for 0.14, so ZIG_VERSION stays pinned.

deny — unrelated, time-triggered

chacha20 0.10.0 and 0.10.1 were yanked upstream after #95's checks ran, which is why that PR was green and main is not. It is reached only transitively via rand -> sqlx-postgres, and a yank is not a security advisory.

The unyanked 0.10.2 was published 2026-08-27 and is still inside the 7-day cooldown, so this adds a temporary [advisories] ignore entry instead. #101 tracks pulling in 0.10.2 and dropping the exception from 2026-09-03.

Verification

deny passes on this PR, which confirms the ignore entry is accepted by the cargo-deny version CI actually installs (0.20.2).

The Docker fix is not covered by this PR's checks — docker.yml triggers on push to main and on release, not on pull_request. It was instead verified by building both images locally from this branch (docker buildx build --platform linux/arm64 and linux/amd64), reproducing the same cross-compile path the workflow uses:

Finished `release` profile [optimized] target(s) in 47.37s
+ install -Dm755 target/aarch64-unknown-linux-musl/release/lur /out/lur

Finished `release` profile [optimized] target(s) in 41.96s
+ install -Dm755 target/x86_64-unknown-linux-musl/release/lur /out/lur

No test accompanies this change: a Docker build-arg pin and a cargo-deny config exception are not reachable by cargo nextest — they are covered by the image and deny CI jobs respectively.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.20%. Comparing base (56750a3) to head (396b388).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #100   +/-   ##
=======================================
  Coverage   91.20%   91.20%           
=======================================
  Files          31       31           
  Lines        4468     4468           
=======================================
  Hits         4075     4075           
  Misses        393      393           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.