chore(agent): update all Rust agent dependencies to latest

[karutoil]

Summary

Bring all catalyst-agent Cargo dependencies (runtime + dev) up to their latest compatible versions, then verify the agent still builds, tests, and runs against the backend.

This is a full refresh beyond Dependabot's weekly Cargo PRs — include major/semver bumps where feasible, with intentional decisions documented for anything we intentionally pin or defer.

Scope

Item	Path
Manifest	catalyst-agent/Cargo.toml
Lockfile	catalyst-agent/Cargo.lock (if present / committed)

Key crates to refresh

• Tokio, tracing / tracing-subscriber
• tokio-tungstenite, rustls, reqwest (rustls stack)
• serde / serde_json / toml
• containerd-client, tonic, prost-types
• russh / russh-keys / russh-sftp / ssh-key
• sysinfo, nix, aes-gcm, sha2, uuid, chrono, thiserror
• Dev: tempfile

Acceptance criteria

• Audit current vs latest (cargo outdated or crates.io / cargo update -n dry checks).
• Update all feasible crates to latest; document any intentionally skipped majors (reason + follow-up).
• Resolve feature-flag and MSRV implications; keep edition = "2021" unless a deliberate edition bump is in scope.
• cargo build and cargo build --release succeed.
• cargo test passes.
• TLS/WebSocket path still works (agent ↔ backend) after rustls / tungstenite / reqwest bumps.
• containerd / gRPC path still compiles after tonic / prost / containerd-client bumps.
• SSH path still compiles after russh stack bumps.
• Release profile settings (lto, strip, panic = "abort", etc.) remain intentional and green.
• PR notes call out breaking API changes and any config.toml / protocol impacts.

Suggested approach

1. Install/use cargo outdated (or equivalent) and capture the baseline from catalyst-agent/.
2. cargo update for compatible bumps first; then bump semver majors in Cargo.toml stack-by-stack:
   • async runtime / tracing
   • TLS + HTTP + WebSocket
   • containerd / tonic
   • SSH
   • misc (sysinfo, nix, crypto)
3. Fix compile errors per stack; re-run tests after each cluster of upgrades.
4. Smoke: agent connects, heartbeats, exec/file ops, and (if applicable) container workflows.
5. Open a single PR (or stacked PRs for large majors like russh / tonic).

Notes

• Dependabot already watches /catalyst-agent weekly (.github/dependabot.yml). This issue is the deliberate full-upgrade pass.
• Be careful with dual rand / crypto crate graphs and rustls feature selection (ring, native roots).
• rand_08 is an explicit package rename pin — re-evaluate whether it can move to a single rand version.
• Agent version in [package] should stay aligned with monorepo release process unless this PR is part of a release.

Related

• Frontend companion: chore(frontend): update all frontend dependencies to latest #219
• Backend companion: chore(backend): update all backend dependencies to latest #220

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}