fix(deps): replace yanked chacha20 0.10.0 in test-runner graph #70

Problem

Cargo.lock on current fork master 9316763ae6fc4c2e16ef1ae668c195593dfab106 retains yanked chacha20 0.10.0. The existing yanked = "deny" policy now fails, including PR69's cargo-deny job. The Blend source correction in that PR does not modify the dependency graph.

The normal-dependency path is testing-framework runners → tokio-retry 0.3.2 → rand 0.10.1 → chacha20 0.10.0. Including development dependencies also reaches rand 0.10.1 through quickcheck 1.1.0 in the two Merkle-tree crates. The workspace's direct rand 0.8/rand_chacha 0.3 declarations are separate and do not need upgrading for this fix.

RustCrypto yanked both0.10.0 and0.10.1 after fixing an SSE4.1 intrinsic used in the SSE2 RNG/legacy backend. The corrected patch release is0.10.2: upstream fix and release discussion.

Reproduction and expected fix

Run the repository's pinned cargo-deny0.19 command against the locked workspace. It reports error[yanked] for chacha20.

Update only that lock entry to0.10.2 and its registry checksum. Keep dependency requirements, features, source pins, public interfaces, and all policy checks unchanged. Verify the retry/testing-framework consumer and combine with the independent Blend correction for whole-workspace checks; no advisory suppression or broad dependency refresh.