fix(security): bump ruint past RUSTSEC-2026-0220 in prediction-markets lockfile

[proerror77]

Change contract

rust_hft/prediction-markets/Cargo.lock must not pin ruint below 1.20.0 (RUSTSEC-2026-0220: Uint shift operations incorrect overflow flags/truncated shift amounts).

Background

PR #522 fixed the main workspace lock (rust_hft/Cargo.lock → ruint 1.20.0) but the prediction-markets workspace lock was left at 1.19.0. The ploy-ci Dependency audit job fails repo-wide for any PR that triggers that lane (observed on #560 and #559, blocking the merge queue).

Acceptance

• cargo update -p ruint in rust_hft/prediction-markets → lock at ≥1.20.0
• Dependency audit job green
• cargo check -p ploy --locked green

Out of scope

• Unmaintained-crate warnings (backoff/bincode/derivative/instant) — they do not fail the job