build(deps): migrate remaining crates to thiserror 2.0.20

[echobt]

Summary

• Recreates conflicting Dependabot PR build(deps): bump thiserror from 1.0.69 to 2.0.20 #30 from current main (b79c8efc0a42364562a4a29506805b53fc521ae4). The edited Dependabot branch could no longer rebase automatically; build(deps): bump thiserror from 1.0.69 to 2.0.20 #30 is now closed as superseded.
• Migrates the eleven remaining direct thiserror 1.x consumers to the shared workspace dependency and raises its minimum to 2.0.20.
• Removes the eleven obsolete compatibility exceptions and regenerates only the corresponding lockfile edges. All 37 direct consumers now inherit workspace 2.0.20. External package versions and checksums are unchanged; transitive 1.x requirements remain intact.
• No CLI version bump, tag, release, runtime logic, UI, or generated schema changes.

Test plan

All checks below passed locally on the PR head:

• cargo fmt --all -- --check
• ./scripts/clippy.sh --locked
• cargo test --locked --workspace: 6,187 passed, 0 failed, 212 existing ignored tests/doctests
• Focused tests for all eleven migrated crates: 334 passed, 0 failed, 28 existing ignored tests/doctests
• TUI / snapshot tests included in the complete workspace suite; no TUI surfaces changed
• cargo audit and cargo machete --with-metadata
• 28 readiness policy unit tests; source/dependency policy against the actual base SHA: zero regressions or policy failures (178 existing findings retained)
• Release-age policy against the actual base SHA: no new external versions
• python3 scripts/readiness/schema.py: both generated API contracts are fresh
• Locked CLI/server build and python3 scripts/readiness/qa.py: all 15 real local functional/security cases pass, without contacting the coding service
• cargo llvm-cov nextest --locked -p cortex-cli -p cortex-app-server -p cortex-common --profile ci --lcov --output-path target/readiness/lcov.info and the real-base changed-line gate: pass; zero executable changed lines
• ./scripts/check-cli-version.sh and git diff --check

Attestation (required)

• Security reviewed: dependency-only diff reviewed for auth, exec/sandbox, paths, network, and secret-handling impact. No behavior or policy bypass changes.
• Product-facing errors: no user-visible copy changed.
• TUI verified: no UI changes; the full workspace suite includes headless TUI tests.
• Tests added: no new logic needing new tests; existing crate tests exercise the derive migration. No mock-success paths added.
• No secrets: no credentials, tokens, keyring dumps, or .env files included. Local diagnostic artifacts remain uncommitted.

Risk

Low, dependency-derive migration only. The workspace already locks thiserror and thiserror-impl 2.0.20. Validation ran on Linux; native Windows/macOS execution and live coding-service flows were not exercised. Protect main currently requires zero approving reviews. CI and the requested Greptile review are being monitored before squash merge. No release will be cut.

[echobt]

@greptileai review

Please review this focused replacement of #30. All remaining direct thiserror 1.x consumers now inherit workspace 2.0.20, and only their dependency edges and obsolete compatibility exceptions changed. No external locked versions, release files, or runtime source changed.

[echobt]

Validation is complete for 5d324797b533c584ddf7fa490d357a440cfd1fe4: all 12 CI checks succeeded, and GitHub reports this PR MERGEABLE with a clean merge state. Full local workspace tests (6,187 passed), Clippy, audit, dependency policy, generated contracts, all 15 local QA cases, and the real-base coverage gate passed. #30 is closed as superseded. No release or tag was created.

The remaining cloud merge gate is external: Greptile has produced no review. Its check suite 92463928516 remains queued since 2026-09-07T14:18:25Z with zero check runs. The manual @greptileai review request has not received a response, and requesting a suite rerun returns HTTP 404. I did not bypass the review gate or change repository settings.

A maintainer needs to restore or trigger the Greptile review, then squash-merge this PR once it passes. Protect main currently requires zero approving reviews, so this is not a self-approval restriction.