fix(deps): widen state-history-forensic to 0.2

[h4x0r]

The last step of the state-history-forensic 0.1 -> 0.2 chain. "0.1" cannot
reach 0.2.x — for a 0.x crate cargo treats the minor as the major — so this
crate sat on the 0.1 line with no lock refresh able to cross it.

Why this went last

Widening here first was tried, and measured. It does not converge:

state-history-forensic v0.1.1
└── forensic-vfs v0.7.0            # then, after 0.7.2 shipped:
└── forensic-vfs-resolver v0.3.1
    └── forensic-vfs-engine v0.1.9

Both published members of the forensic-vfs workspace carried the old
requirement, so both had to release — 0.7.2 and 0.3.2 — before a consumer's
graph could resolve one version. deny.toml sets multiple-versions = "warn",
so a leaf-first fix would have gone green over the duplicate and nobody would
have seen it.

Also unsticks two lock lags

Separate from the requirement, this crate's lock had drifted:

• forensic-vfs 0.7.0 → 0.7.2 — 0.7.1 published and was never picked up
• state-history-forensic 0.1.0 → 0.2.1 — 0.1.0 still declares
  rust-version = 1.85, the over-declared floor the 0.1.1 backport existed to
  correct, so this crate was building against the un-fixed version

Neither is addressed by rangeStrategy: "bump"; they are lock-level staleness,
not requirement-level.

Evidence

• cargo tree -i state-history-forensic@0.1.1 → did not match any packages
• one 0.2.1 entry in Cargo.lock, no second version
• cargo tree -d duplicate set byte-identical to origin/main's — 35
  pre-existing duplicate pairs, none added. state-history-forensic appears in
  neither set.
• cargo metadata --locked passes
• cargo test --workspace --all-features --no-fail-fast → 90 passed, 0 failed,
  33 targets, exit 0

Noticed in passing, not addressed here

cargo tree -d shows two of our own crates duplicated in this graph —
safe-read 0.1.0 vs 0.2.1 and zip-forensic-core 0.1.0 vs 0.2.0. Same class of
problem as this PR, one narrow requirement upstream holding an old line alive.
Pre-existing and out of scope, but worth its own pass.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	forensic-vfs@​0.7.2
	forensic-vfs-resolver@​0.3.2
	state-history-forensic@​0.2.1

View full report