2.1.1

Patch release: dependency updates, Rust 1.91.0 MSRV alignment, deterministic
simulation CI migration, and WebSocket/WSS upgrade-path buffering fixes.

✨ Added

• test(sim): moonpool-sim-driven deterministic UDP simulation. A new
  test-only workspace crate sim/ (sozu-sim, publish = false) hosts a
  deterministic simulation of the sans-io UDP core
  (sim/tests/udp_simulation.rs) driven by the moonpool-sim
  engine (seeded runtime, virtual clock, RNG, buggify fault injection). It
  ports the former handmade harness's weighted action grammar, shadow model,
  cross-step invariants and determinism guard onto moonpool, keeping the
  SOZU_UDP_SIM_SEED/_SEEDS/_STEPS replay/sweep knobs, and replaces it:
  the handmade lib/tests/udp_simulation.rs is removed — moonpool is now the
  sole UDP deterministic-sim. lib//bin/ stay async-free: moonpool/tokio are
  sim/ dev-dependencies only. moonpool-sim
  is pinned to a git rev (the published 0.7.0 doesn't build on stable; main
  does) — swapping to a crates.io release later is a follow-up, not a blocker.

🔄 Changed

• MSRV bumped 1.88.0 → 1.91.0 (rust-toolchain + every crate's
  rust-version). Required by moonpool-sim, which uses Duration::from_hours
  /from_mins — const-stable only since Rust 1.91. moonpool also needs
  --cfg tokio_unstable (it seeds tokio's runtime RNG via the unstable RngSeed
  API for scheduler determinism), but it is scoped to the sozu-sim build
  only — the moonpool dev-deps live under [target.'cfg(tokio_unstable)'.dev-dependencies]
  and the harness is #![cfg(tokio_unstable)]-gated, so cargo test --workspace
  and every production build stay free of the flag (the sweep sets it via
  RUSTFLAGS). No workspace-wide .cargo/config.toml.
• chore(lint): resolved the Rust 1.91 clippy lints (collapsible_if,
  manual_is_multiple_of, derivable_impls, mismatched_lifetime_syntaxes)
  surfaced across lib/command/bin by the MSRV bump. No behavior change.

🐛 Fixed

• fix(pipe): WebSocket/WSS server-first frames are flushed after 101 Switching Protocols.
  The post-upgrade pipe now arms writable readiness when bytes enter either
  sozu-owned direction buffer, so edge-triggered epoll cannot park a backend
  frame such as Pusher/Reverb connection_established until the client sends
  its first WebSocket frame. It also arms writable readiness for bytes already
  inherited from the H1 mux during upgrade, including a backend frame carried in
  the same read buffer as the 101 Switching Protocols response.

🤖 CI

• ci(sim): the moonpool sozu-sim sweep is the sole UDP swarm. A per-PR
  udp-simulation job runs a modest seeded sweep (with --cfg tokio_unstable),
  and the nightly simulation-sweep workflow goes deep — seed-bounded to fit the
  45-min cap, since moonpool's per-seed tokio-runtime construction is ~100× slower
  per seed-step than the former pure-sync handmade swarm. All CI toolchain pins
  move 1.88.0 → 1.91.0.

🔐 Security

• chore(deps): bump anyhow 1.0.102 → 1.0.103 for
  RUSTSEC-2026-0190
  (unsoundness in Error::downcast_mut() after Error::context()). Lockfile-only
  — the workspace ^1.0.102 requirement already permitted it; restores a green
  cargo audit --deny warnings.