chore(deps): revert 5 dependabot major-version bumps that broke CI

Five dependabot major bumps merged 2026-05-29 in a single chain without
the call sites being updated:

  #120  axum       0.7.9   → 0.8.9
  #121  rand       0.9.4   → 0.10.1
  #122  criterion  0.5.1   → 0.8.2
  #123  nom        7.1.3   → 8.0.0
  #124  rustyline  15.0.0  → 18.0.0

All five auto-merged green (per the estate's auto-merge hook) because
`Validate K9 contracts` / `governance / Code quality` are content checks
that don't compile the workspace. The real `Rust CI` job and the
`Live Provers` workflow have been red on `main` for every push since:

  error[E0599]: no method named `random_range` found for struct `StdRng`
                in the current scope
    --> src/rust/agent/swarm.rs:250:32
    ::: .../rand-0.10.1/src/rng.rs:159:8

  error[E0618]: expected function, found `Choice<(fn(_) -> Result<…>>
    --> src/rust/provers/lean.rs:24:38
    [nom 8's `alt(...)` no longer returns a callable closure]

Root cause: each bump shipped a real API break that needed call-site
updates:

  * rand 0.10 renamed the `Rng` trait to `RngExt` (because upstream
    `rand_core` renamed `RngCore` → `Rng`). Existing `use rand::Rng`
    no longer imports `random_range` / `random` methods.

  * nom 8 moved from closure-based to trait-based combinators —
    `alt(args)(input)` is now `alt(args).parse(input)` everywhere.

  * axum 0.8, criterion 0.8, rustyline 18 also ship breaking changes
    that the call sites have not been updated for (reverted in the
    same commit to keep CI green; bumping any one of them individually
    requires the matching code update).

Resolution: revert all five back to the May-28 working state. Locally
`cargo check --lib` cleans in ~2 min against this lockfile.

The bumps are NOT being thrown away — they should land again as 5
follow-up PRs, each bundling the matching code update. That keeps
"dependabot caught a major version" signal alive while preventing
this class of break.

Effect: `Rust CI`, `Live Provers` (Tier-1 + Tier-2 matrices) and
`MVP Smoke` should return green on this branch.

Refs: #92 (broader baseline failures — this PR addresses the
compile-error slice that gates everything downstream).

Author: hyperpolymath