chore(deps): apply available major bumps (sha2 0.11, rand 0.10) and tighten maintenance spec

[chaliy]

What

Follow-up to #105. That PR only ran cargo update, which by definition is SemVer-compatible and skipped the two available major bumps. Apply them now and tighten the maintenance spec so this doesn't recur.

• sha2 0.10 → 0.11 (bot-auth feature)
• rand 0.8 → 0.10 (bot-auth feature)
• specs/maintenance.md §1 rewritten to require evaluating and applying available major bumps via cargo upgrade --incompatible, with deferred bumps called out explicitly in PR + changelog.

Why

The maintenance spec already said "Major version upgrades are allowed; review changelogs for breaking changes and adapt code accordingly" — but the wording let a partial pass slip through. Tighten it so future passes (human or agent) treat major bumps as a mandatory checklist item, not a stretch goal.

For the actual bumps: keeps the optional bot-auth feature on supported upstream crypto/RNG versions and avoids drifting onto unmaintained 0.8/0.10 lines.

How

• sha2 0.11 is API-compatible for our Digest + Sha256 usage; no source change.
• rand 0.10 removed rand::thread_rng() and no longer re-exports RngCore at the crate root. Switched bot_auth::generate_nonce from rand::thread_rng().fill_bytes(&mut bytes) to let bytes: [u8; 32] = rand::random(); — the idiomatic 0.10 API for fixed-size random arrays. Same cryptographic source (ThreadRng → OsRng chain), same 32-byte nonce.
• Verified with and without --features bot-auth. Both pass clippy -D warnings, all 280+ tests, doctests, release build.

Risk

• Low. Single behavior-bearing code change (generate_nonce) is functionally equivalent. Bot-auth feature is opt-in, no default-feature consumer affected.
• ed25519-dalek 2.x still depends on rand_core 0.6 internally; cargo resolves it side-by-side with rand 0.10 which uses rand_core 0.9. No conflict at link time.

Checklist

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --features bot-auth -- -D warnings
• cargo test --workspace --exclude fetchkit-python (default features)
• cargo test --workspace --exclude fetchkit-python --features bot-auth
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --exclude fetchkit-python --features bot-auth --no-deps
• cargo build --workspace --exclude fetchkit-python --release --features bot-auth
• specs/maintenance.md updated
• CHANGELOG.md [Unreleased] updated

---

Generated by Claude Code