build(deps): refresh workspace pins and prune stale deny.toml policy

[varex83agent]

Closes #594.

Relaxes the over-precise patch pins the lockfile had outgrown (clap, axum, tokio-util, tracing, tracing-subscriber, async-trait, built, criterion) to minor precision. Bumps sha3 0.10 -> 0.11 (the only RustCrypto crate whose old generation was used solely by Pluto), consolidating sha3 and keccak onto the single generation alloy-primitives already pulls. Leaves rand/rand_core and the aes/ctr/cipher/pbkdf2/sha2/scrypt stack deliberately pinned (documented inline): their old generations are held by the libp2p/alloy/k256/ssz ecosystem, so a bump would add a second generation rather than drop the shared one, and the API break is non-trivial. Prunes the two stale deny.toml entries (the unreachable attohttpc MPL-2.0 exception and the retired wasm32-wasi target), and refreshes the yanked chacha20 0.10.1 -> 0.10.2 so cargo deny passes. vise/vise-exporter git pins untouched (#126).

cargo deny duplicate crates: 30 -> 29 (removed sha3 + keccak; sha3 0.11 adds const-oid 0.10). All gates green: fmt, clippy, test, deny.

Co-Authored-By: Bohdan Ohorodnii 35969035+varex83@users.noreply.github.com