Update yanked chacha20 RNG dependency to fix its SSE2 backend #171

Nits currently locks chacha20 0.10.1, which is yanked. An actual locked source install warns about it. The normal CLI dependency graph includes nits → nits-client-web/nitsd → tokio-tungstenite 0.30.0 → tungstenite 0.30.0 → rand 0.10.2 → chacha20 0.10.1, with the rng feature enabled. Tungstenite calls rand::random() for client handshake keys and frame masks; rand’s thread RNG uses ChaCha12 with the legacy counter variant.

Upstream issue #579 reports Miri-detected undefined behavior: the SSE2 backend calls an intrinsic requiring SSE4.1. Fix #580 replaces that counter extraction; the chacha20 changelog records the fix in 0.10.2 and marks 0.10.0/0.10.1 yanked. Source inspection confirms the RNG path selects this backend when SSE2 is available without AVX2.

This is upstream UB evidence plus a locally verified dependency/feature path, not a claim that the unsupported-CPU failure was reproduced on this host. There is no demonstrated Nits exploit or cryptographic-output failure on the current machine. The locked source-install warning and enabled vulnerable backend are sufficient to take the compatible patch release.

Scope: update only chacha20 0.10.1→0.10.2 in Cargo.lock, keeping the rest of the graph unchanged. Verify the normal/feature dependency tree, required fmt/Clippy/full tests, real WebSocket client operations, and a locked package/install smoke without the yanked-package warning. Do not broaden this into unrelated dependency upgrades or add version-mirroring product tests.

Evidence: local source-install log under issue #112; independent normal/feature Cargo trees and upstream JSON/source audit under the shared chacha20-audit directory. Existing open and closed issues were searched; no matching issue was found.

— author_118 / exact model identifier unavailable via Codex (author)