chore: align workspace with Rust best practices (edition 2024, MSRV CI, deps, profiles)

[pofallon]

Conformance pass against current Rust packaging/organization norms (Cargo Book, API guidelines, docs.rs/release tooling). Driven by a project-wide best-practices audit.

Edition & MSRV

• Migrate both crates to edition 2024 + resolver = "3" (MSRV-aware resolver), bump rust-version to 1.85. Ran cargo fix --edition for the mechanical changes (match-ergonomics, import ordering); edition-2024 rustfmt accounts for most of the line count.
• Add an MSRV CI job pinned to 1.85 (cargo check --workspace --all-targets --all-features --locked) so the declared MSRV is actually verified instead of aspirational.

unsafe_code: forbid → deny, with zero unsafe added

Edition 2024 makes std::env::set_var/remove_var unsafe. Rather than scatter #[allow(unsafe_code)], the env mutation is eliminated:

• Production (the 2 sites): cli.rs threads the default log directive into a new init_with_redaction_and_directive instead of mutating RUST_LOG; docker_retry.rs replaces its env round-trip test seam with an atomic counter (also fixes a latent race).
• Tests: subprocess tests set env on the child Command; in-process tests use the temp-env crate (scoped + serialized). Result: no unsafe and no #[allow(unsafe_code)] anywhere; deny stays meaningful.

Dependencies

• Hoist serde, serde_json, tokio (union of features), futures, tar, sha2, regex, zip, tempfile, assert_cmd, testcontainers into [workspace.dependencies]. Fixes the confirmed regex (1.0 vs 1.10) and zip (2.1 vs 2.4) divergences.

Packaging / build profiles

• publish = false on both crates (this is a consumer CLI shipped as prebuilt binaries, not a crates.io library); documentation now points at the repo.
• [profile.release]: lto = "thin", codegen-units = 1, strip = true — and drop the fragile shell strip … || true from the release workflow (rustc strips cross-platform now). Moved dev debug = 1 from a global rustflag (which also bloated release) into [profile.dev].

CI / hygiene

• clippy now runs with --all-features (previously feature-gated full code was unlinted in CI).
• Standardize codeql.yml checkout to actions/checkout@v6.
• Clarify the full = [] compile-gate feature comment.
• Silence a pre-existing dead-code warning in the --no-default-features MVP build (resolve_features_ordered is only reachable under full).

Deliberately NOT changed

• deny.toml multiple-versions stays warn: the duplicates are transitive (thiserror 1/2, getrandom, windows-sys, …), not hoistable — flipping to deny would break CI.
• No crates.io publish step or [package.metadata.docs.rs] (moot under publish = false).

Verification

• cargo fmt --all -- --check ✅
• cargo clippy --workspace --all-targets --all-features -- -D warnings ✅
• make test-nextest-fast → 2161 passed ✅
• default / --no-default-features MVP / --release builds all green ✅

🤖 Generated with Claude Code