Complete dependency roll

[yvette-carlisle]

Summary

• bump rmcp to 2.0.0 and refresh Cargo.lock
• reconcile pending GitHub Actions dependency PRs with full-SHA pins:
  • actions/checkout@v7.0.0 -> 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
  • actions-rust-lang/setup-rust-toolchain@v1.17.0 -> 166cdcfd11aee3cb47222f9ddb555ce30ddb9659
  • taiki-e/install-action@v2.82.0 -> b8cecb83565409bcc297b2df6e77f030b2a468d5
  • softprops/action-gh-release@v3.0.1 -> 718ea10b132b3b2eba29c1007bb80653f286566b
• covers Dependabot PRs Bump rmcp from 1.7.0 to 2.0.0 #286, Bump actions-rust-lang/setup-rust-toolchain from 1.16.1 to 1.17.0 #248, Bump softprops/action-gh-release from 3.0.0 to 3.0.1 #224, Bump actions/checkout from 6.0.3 to 7.0.0 #208, and Bump taiki-e/install-action from 2.81.11 to 2.82.0 #206

Verification

• cargo update --verbose
• cargo make fmt
• cargo make check
• cargo audit (3 allowed warnings only: number_prefix, paste, rustls-pemfile)
• cargo make check-trace-gate
• cargo make test-e2e
• cargo make test-rust-all

Notes

• cargo update --verbose still reports transitive unchanged crates crypto-common v0.1.6 via sqlx/sha2 and matchit v0.8.4 via axum; these are upstream transitives, not direct manifest dependencies.