Plan and test major Rust dependency upgrades

[ewilhelm1979-netizen]

Context

Dependabot opened major Rust dependency updates that should not be merged as routine maintenance:

• Bump hmac from 0.12.1 to 0.13.0 in /rust/iscy-backend #10 — hmac 0.12 to 0.13
• Bump calamine from 0.26.1 to 0.35.0 in /rust/iscy-backend #11 — calamine 0.26 to 0.35
• Bump getrandom from 0.3.4 to 0.4.3 in /rust/iscy-backend #13 — getrandom 0.3 to 0.4
• Bump sha2 from 0.10.9 to 0.11.0 in /rust/iscy-backend #17 — sha2 0.10 to 0.11

These upgrades may change APIs, behavior, parser assumptions, cryptographic call patterns, or platform compatibility. Their automated pull requests were closed and retained here as explicit migration work rather than silently ignored.

Required work

• review upstream migration notes and security implications
• update one dependency at a time on a dedicated branch
• add or update focused tests for the affected code paths
• run formatting, Clippy, locked tests, advisory checks, license/source checks, HTTP/DB smoke, Nix smoke, Compose validation, and the Docker build
• document compatibility effects and rollback considerations

Priority

V23.7.27 and the mandatory supply-chain gate are now established on main. Schedule these upgrades individually after the remaining patch-level Dependabot updates have been validated.