fix: resolve remaining RustSec advisories

[mstuart]

Summary

• update anyhow, crossbeam-epoch, h2, memmap2, and the tokio-postgres dependency family to patched compatible releases
• upgrade git2 to 0.21 and safely reject blame hunks without a final signature
• pin the immutable upstream Tantivy revision from Update lru requirement from 0.16.3 to 0.18.2 quickwit-oss/tantivy#3034, which moves lru to the first panic-safe release

Security result

The pre-change RustSec scan found 5 vulnerabilities and 5 unsoundness advisories. The final scan reports:

• 0 vulnerabilities
• 0 unsoundness advisories
• 0 yanked dependencies

Four informational unmaintained notices remain (core2, instant, number_prefix, and paste). RustSec lists no patched releases for them; each is transitive through fastembed or notify, not a direct dependency.

Verification

• cargo fmt --package code-memory -- --check
• cargo clippy -- -D warnings
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test with the CI PostgreSQL schema and TEST_DATABASE_URL (93 passed, 1 intentionally ignored)
• cargo test --all-features (93 passed, 1 intentionally ignored)
• cargo build --release --all-features
• cargo audit (0 vulnerabilities, 0 unsoundness advisories)
• npm ci --ignore-scripts
• npm run check
• npm exec -- ultracite doctor (4 passed, 0 warnings, 0 failed)
• npm audit --audit-level=high (0 vulnerabilities)
• npm pack artifact inspection (5 expected files)
• native release CLI and npm wrapper CLI smoke tests

TDD evidence: the missing-blame-signature regression failed before the compatibility helper existed, then passed after the git2 0.21 migration.