fix(docker): unbreak the arm64 image build, and ignore the yanked chacha20

[henry40408]

Two unrelated breakages, both of which make main red right now.

1. arm64 image build (Dockerfile)

Broken since #156 landed Rust 1.98. rustc now passes
-Wl,--fix-cortex-a53-843419 for aarch64-unknown-linux-musl
(rust-lang/rust#155453) and zig's linker rejects it:

error: unsupported linker arg: --fix-cortex-a53-843419
error: could not compile `pingward` (bin "pingward") due to 1 previous error

cargo-zigbuild filters that arg from 0.23.0 onward
(rust-cross/cargo-zigbuild#452, fixing rust-cross/cargo-zigbuild#451); the
Dockerfile pinned 0.22.3, which predates it — src/zig.rs:541 at v0.23.0
carries the filter, v0.22.3 does not.

ZIG_VERSION stays at 0.14.1 — 0.23.0 still supports it, and the libc++-19
bindgen caveat the existing comment names only applies to zig 0.15+.

2. yanked chacha20 (deny.toml)

cargo deny check fails on every branch with
error[yanked]: detected yanked crate (try 'cargo update -p chacha20').
chacha20 0.10.1 was yanked upstream; it is not an advisory and it reaches us
transitively via rand. 0.10.0 is yanked too, so 0.10.2 (published 2026-08-27)
is the only non-yanked stable release — inside the 7-day hold on fresh
releases. Ignored until it clears on 2026-09-03; #162 tracks the removal.

Verification

The Dockerfile change is not reachable from the test harness: ci.yml never
cross-compiles, and docker.yml only runs on a push to main or a tag, so the
arm64 build is first exercised after merge. The deny.toml change is covered by
the cargo-deny job on this PR.

Failing runs for reference:

• arm64 image: https://github.com/henry40408/pingward/actions/runs/33187502617
• cargo-deny on main: https://github.com/henry40408/pingward/actions/runs/33187077266

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.31%. Comparing base (a370597) to head (c301296).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #161   +/-   ##
=======================================
  Coverage   96.31%   96.31%           
=======================================
  Files          28       28           
  Lines       13132    13132           
=======================================
  Hits        12648    12648           
  Misses        484      484           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.