[davlgd]

Problem

The CI and dependency fixes originally proposed here have largely landed in #395. This PR completes the remaining lockfile refresh on top of the current main branch.

Root cause

The previous branch was based on the lockfile before #395. Its independent zip API adaptation and dependency versions conflicted with the merged maintenance changes.

Solution

• Retain the remaining semver-compatible lockfile updates, including quinn-proto 0.11.16 -> 0.11.19 and chacha20 0.10.1 -> 0.10.2.
• Preserve the versions already merged on main, including zip 9.1.3, ctutils 0.4.6, async-trait 0.1.92, and the rustls fixes.
• Keep main's AWS SDK feature selection and archive error handling. The crypto-bigint dependency and the proposed RUSTSEC-2026-0387 ignore are absent.

The resulting diff against main changes only Cargo.lock.

Review

• Correctness and security: checked the resulting dependency graph and registry sources; no new advisory ignores or SDK feature changes.
• Compatibility: manifests, source code, and output schemas match main; the Rust 1.92 workspace build passes.
• Test coverage: the workspace tests and Golden output tests pass with the refreshed dependencies.

Validation

• git diff --check
• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked
• cargo test --package rustfs-cli --test golden --features golden --locked
• cargo +1.92.0 build --workspace --locked
• cargo deny check advisories

All commands passed locally on macOS. Cross-platform checks run in CI.