build(deps): move chacha20 off the yanked 0.10.1

chacha20 0.10.1 is yanked on crates.io. It reaches this tree through rand, which
is a direct dependency, so it sits on the built path rather than off to one side.
The requirement in Cargo.toml already admitted 0.10.2, so this is a lockfile
change and nothing else moved: the diff is the chacha20 package entry and rand's
reference to it.

This is not a security fix. cargo audit reports nothing against chacha20 at
either version, and 0.10.1 was withdrawn by its maintainer rather than flagged by
an advisory. What the move buys is that a fresh checkout resolves without
reaching for a yanked version.

Gated on the branch: fmt, build, clippy with -D warnings and the library tests
all pass, 2314 tests and 0 failed, and the six repo guards exit 0.

CHANGELOG.md

@@ -30,6 +30,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   interval instead. That retry interval gates only a peer whose last attempt
   failed, so it cannot clamp a `heartbeat_interval_secs` configured below it.
 
+### Changed
+
+- The lockfile moves `chacha20` from 0.10.1 to 0.10.2, because 0.10.1 is yanked.
+  It arrives through `rand`, a direct dependency,
+  so it sits on the built path rather than off to one side. The requirement in
+  `Cargo.toml` already admitted 0.10.2, so this is a lockfile change and no code
+  changed with it. **This is not a security fix**: `cargo audit` reports nothing
+  against `chacha20` at either version, and 0.10.1 was withdrawn by its
+  maintainer rather than flagged by an advisory. What it buys is that a fresh
+  checkout can resolve the lockfile without reaching for a yanked version.
+
 ## [0.5.1] - 2026-09-06
 
 ### Fixed

Cargo.lock

@@ -498,9 +498,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -2614,7 +2614,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]