chore: adapt to upstream dep bumps merged into main during rebase

Main absorbed five dependabot patches while this branch was in flight:
- criterion 0.5 → 0.8 (PR #30)
- sha2 0.10 → 0.11 (PR #23)
- proptest, axum-server, oxigraph, esbuild, credo, exqlite, jason,
  stream_data (build deps, no API change for us)

Two breaking API changes needed adaptation:

sha2 0.11:
  GenericArray no longer implements LowerHex, so `format!("{:x}", digest)`
  fails to compile. Switched to per-byte format:
  - rust-core/verisim-provenance/src/lib.rs (hash_record_chain + genesis_hash)
  - rust-core/verisim-api/src/federation.rs::sha256_hex

criterion 0.8:
  Deprecated `criterion::black_box` in favour of `std::hint::black_box`
  (criterion now re-exports for back-compat but emits deprecation
  warnings that -D warnings catches). Switched the import in
  benches/modality_benchmarks.rs to the std re-export.

Plus rustfmt re-flow on a few argument lists where the bench/test
function call sites now fit on one line under the standard width.

Verification post-rebase:
- cargo check --workspace: clean
- cargo clippy --workspace --all-targets -- -D warnings: clean
- cargo fmt --check: clean
- cargo test --workspace: 592 passed / 0 failed / 6 ignored
- cargo bench --no-run: clean

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Author: claude