Bump native deps: thiserror 2, sha2 0.11, zstd 0.14, zstd-safe 8, serde 1.0.229

[samifouad]

What changed

Applies the five open dependabot bumps in one commit (bot PRs #10–#14 can be closed — Sami prefers no bot contributors):

• thiserror 1.0 → 2.0.18
• sha2 0.10 → 0.11
• zstd 0.13 → 0.14 + zstd-safe 7 → 8 (must land together; zstd-safe 8 alone fails, as its bot PR's red CI showed)
• serde 1.0.228 → 1.0.229

One code change: sha2 0.11's digest output array no longer implements LowerHex, so the three format!("{:x}", digest) sites (plus one in the topology test) now share one hex_encode helper. Output format is byte-identical (lowercase hex, no separators) — that's what signed-manifest hash comparison depends on, and the update tests cover it.

Evidence

• cargo test --all-features → all suites pass except one pre-existing flake on main: concurrent_writes_leave_a_complete_private_token_and_no_temp_files (token temp-name race, AlreadyExists on pid+nanos temp names). Verified it fails identically with my changes stashed on c1600ee, and passes in isolation 6/6. Filed as token_file: concurrent write_token races on temp name (flaky test on main) #24.
• cargo clippy --all-features --all-targets → 0 warnings.
• The three green bot PRs (chore(deps): bump thiserror from 1.0.69 to 2.0.18 #10/chore(deps): bump zstd from 0.13.3 to 0.14.0 #11/chore(deps): bump serde from 1.0.228 to 1.0.229 #12) confirm thiserror 2 / zstd 0.14 / serde bump individually; this PR adds the sha2 fix their red CI (chore(deps): bump sha2 from 0.10.9 to 0.11.0 #13/chore(deps): bump zstd-safe from 7.2.4 to 8.0.0 #14) was missing.

closes #10
closes #11
closes #12
closes #13
closes #14
-kimi