add global-min-publish-age - #492

Two conflicts resolved against the v0.10.0 base: security-audit.yml
adopts the cooldown step onto that release's audit workflow, which
still uses actions-rs/audit-check, and Cargo.lock is reconciled onto
v0.10.0's dependency tree rather than main's. Dropping the pinned
reqwest-eventsource collapses a duplicate copy of the crate that
v0.10.0 carried at both 0.5.0 and 0.6.0.

Co-authored-by: Manuel Iñaki Bilbao <manuel.bilbao@lambdaclass.com>
(cherry picked from commit 0d3eb68)

…mbdaclass#607)

## 🗒️ Description / Motivation

Ports Commit-Boost/commit-boost-client#492. Cargo's unstable
`min-publish-age` (rust-lang/cargo#17009) lets the resolver skip crate
versions published less than N days ago, a cooldown against freshly
compromised releases. This enables it at 14 days, adds the Makefile path
for resolving under it, and makes every build `--locked` so stable cargo
cannot silently re-resolve around the policy.

The feature is nightly-only; stable 1.97.1 ignores the tables silently.
Only the pinned `nightly-2026-06-21` resolver enforces the cooldown, so
`--locked` everywhere is what makes an unresolved manifest change fail
loudly instead of resolving on stable.

## What Changed

| File | Change |
|------|--------|
| `.cargo/config.toml` | `[unstable] min-publish-age = true`,
`[registry] global-min-publish-age = "14 days"` |
| `Makefile` | `make update` (resolve under the cooldown), `make
update-allow PACKAGE= VERSION=` (escape hatch, bypasses the whole
resolution), `make cooldown-check` (advisory). `make lint`/`make test`
now `--locked` |
| `.github/workflows/ci.yml` | `cargo check`/`clippy` run `--locked`;
new `cooldown` job annotates the run with a warning, never fails |
| `Dockerfile` | `cargo chef cook` honors `$LOCKED` like the final
build; the shadow variant still sets it empty |
| `CONTRIBUTING.md`, `CLAUDE.md` | Document the workflow |

## Correctness / Behavior Guarantees

- No manifest or lockfile change. Locked builds are byte-for-byte what
they were.
- A `cargo update --workspace --dry-run` does **not** flag too-new
locked crates, so the check has to be the full `cargo update --dry-run
-Z min-publish-age`, grepping `Downgrading|is too new`. That run also
refreshes git dependencies (leanSig, leanVM, ethrex, rust-libp2p) to
their branch heads with no cooldown; git revs have no publish age and
must be reviewed by hand.
- **Known state today:** a full re-resolution under any window of 8+
days fails with a misleading `rand ^0.10` conflict. Real cause: rand
0.10 needs chacha20 0.10, whose 0.10.0/0.10.1 are yanked and whose only
live release (0.10.2) was published 2026-08-27. `make update` errors and
the CI job emits a "probe failed" warning until 2026-09-10; `make
update-allow` covers an urgent bump before then. The committed lockfile
already pins the yanked chacha20 0.10.0, which any future re-resolution
will move.

## Tests Added / Run

- `make lint` passes with `--locked`.
- Stable `cargo check --locked` and `cargo update --workspace --dry-run
--locked` with the new tables: no warnings, no changes.
- Temporarily pinned `smallvec 1.16.0` (3 days old) and ran the 7-day
dry-run: ` Downgrading smallvec v1.16.0 -> v1.15.2 (...)`, confirming
the grep pattern. Lockfile restored identical.
- Ran the CI step script locally and `make cooldown-check`: both report
the chacha20-driven probe failure as a warning with exit 0.

## Related Issues / PRs

- Related to Commit-Boost/commit-boost-client#492

## ✅ Verification Checklist

- [x] Ran `make fmt` — clean (no Rust changes)
- [x] Ran `make lint` (clippy with `-D warnings`) — clean
- [ ] Ran `make test` — not run; no Rust or fixture changes, only the
`--locked` flag was added