chore(deps): bump scry-sai-core dev-dep to 2.0 (SCPV v3, scry v2.0.0) (#506)

scry shipped a breaking v2.0.0 (provenance wire format reshaped to binary-canonical
SCPV v3). synth-cli pins scry-sai-core only as a DEV-dependency (the shadow-stack
budget test; the production binary doesn't link it until the gated VCR-MEM-001
consumption step). The maintainer confirmed — and this verifies — that synth's
consumed surface (call_graph / function_summaries / stack_usage /
reachable_from_exports / operand_stack) is unchanged and additive-only, so 2.0 is
a transparent bump: scry-sai-core 2.0.0 + synth-cli (binary + tests) build green,
scry_shadow_stack_budget passes, and the frozen byte gate is bit-identical (scry
is not on the codegen path). Keeps the dev-dep aligned with the released major so
the eventual provenance consumption targets SCPV v3, not the v1 binary format that
never connected (scry#63).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: avrabe

Cargo.lock

@@ -69,4 +69,8 @@ gimli = { version = "0.33", default-features = false, features = ["read", "std"]
 # binary does not pull scry until the gated consumption step (the .bss shrink /
 # prologue elision) lands. Test-only ⇒ Bazel (which globs src/ only) never sees
 # it, so no MODULE.bazel pin is needed yet. See scry#51.
-scry-sai-core = "1.12"
+# Tracks scry 2.x (SCPV v3): the major bump reshaped the provenance wire format,
+# but synth's consumed surface (call_graph / function_summaries / stack_usage /
+# reachable_from_exports / operand_stack) is unchanged and additive-only, so the
+# bump is transparent here. See scry#63 / scry v2.0.0.
+scry-sai-core = "2.0"