deps: bump git2 to 0.21, clearing RUSTSEC-2026-0184

[bashandbone]

Follow-up to the item flagged in #79.

Why

git2 0.20.4's BlameHunk accessors construct Signatures from potentially-null pointers, so reading them can dereference null — RUSTSEC-2026-0184. submod never calls blame, and the advisories step allows unsound, so this never failed CI. But the fix is a version bump, so there's no reason to keep carrying it.

The breaking change

0.21 is a breaking release. Five call sites in git2_ops.rs needed updating, all from one API change — accessors that returned Option<&str> now return Result<&str, Error>, distinguishing "not valid UTF-8" from "absent" where the old signature collapsed both into None:

	0.20	0.21
Submodule::name()	Option<&str>	Result<&str, Error>
Submodule::url()	Option<&str>	Result<Option<&str>, Error>
ConfigEntry::name()	Option<&str>	Result<&str, Error>
ConfigEntry::value()	Option<&str>	Result<&str, Error>
StatusEntry::path()	Option<&str>	Result<&str, Error>

Submodule::url() is the awkward one — it grew both wrappers, since a URL can be absent and a present URL can be invalid UTF-8. Call sites use .ok().flatten() to fold both back into an Option, preserving current behavior rather than changing how invalid UTF-8 is treated as a side effect of a dependency bump. That's a real (if narrow) improvement now available, but it belongs in its own change.

Submodule::name() call sites needed no edit at all: Result::unwrap_or has the same shape as Option::unwrap_or, so .unwrap_or(path) still compiles and still means the same thing.

Verification

libgit2-sys moves 0.18.3+1.9.2 → 0.18.7+1.9.6. 569/569 tests pass, cargo fmt --check clean, cargo deny check advisories clean, and RUSTSEC-2026-0184 no longer appears even with the unsound allowance removed. No new clippy warnings — the remaining ones are the pre-existing set on main, none in git2_ops.rs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/git_ops/git2_ops.rs	88.88%	1 Missing ⚠️

Files with missing lines	Coverage Δ
src/git_ops/git2_ops.rs	84.62% <88.88%> (+0.10%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.