chore: add cargo min-publish-age config

[ocavue]

DO NOT MERGE THIS BEFORE 2026-11-12

Adds a 7-day min-publish-age cooldown for cargo dependency resolution, so cargo add/cargo update skip crate versions published less than a week ago (the window in which supply-chain compromises are typically detected and yanked).

Note: this feature is not available yet. It requires cargo 1.100, which ships with stable Rust 1.100.0 on 2026-11-12 (stabilized in rust-lang/cargo#17335, RFC rust-lang/rfcs#3923). Until then the key is inert: today's stable cargo ignores it silently and current nightly prints a one-line warning. Merging early is safe because versions already in Cargo.lock are exempt, so builds and CI are unaffected; enforcement starts automatically once toolchains reach 1.100 (CI installs the latest stable at run time, local machines need rustup update after the release date).

For an urgent bump inside the cooldown window: CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update -p <crate>.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}