Update the dependencies and development tools to their latest releases #617

Context

The owner asked to bring every dependency up to date, development tools included. The workspace had also drifted from a rule of DESIGN.md section 15: pyropdf takes the harfrust release that uses hayro's read-fonts, so that harfrust adds no copy of it. hayro 0.9 moved to skrifa 0.49 and read-fonts 0.46, while the engine stayed on skrifa 0.46 and harfrust 0.13, both on read-fonts 0.43.

Goal

Every direct dependency and every pinned development tool of the repository is at its newest release, except where a recorded reason holds it back, and the lockfiles hold the newest versions that the requirements allow.

Scope

In:

• The Rust dependencies of the workspace and of fuzz/, and both lockfiles.
• The Python build requirement and dependency groups, and uv.lock.
• tools/pdfjs, and its lockfile.
• The workflows' pins: actions, uv, maturin, the fuzz nightly, and the veraPDF jars with their digests.
• Whatever these releases change in the engine, the tests, or the lint results.

Out:

• The [patch.crates-io] of the hayro crates, which waits on hayro-interpret: Expose the font dictionary of a glyph run LaurenzV/hayro#1734 (Build against released hayro again: remove the [patch.crates-io] of LaurenzV/hayro#1734 #603).
• pymupdf 2, which keeps the cap in pyproject.toml: it depends on onnxruntime, whose newest release still has no wheel for Python 3.15.
• The crates and lockfiles under evidence/, which record what each measurement ran.
• harfrust's caller-set limits (Adopt harfrust's caller-set shaping limits once harfrust#571 ships #580).
• The tools installed on a developer's machine.

Paths

Cargo.lock, crates/*/Cargo.toml, fuzz/Cargo.toml, fuzz/Cargo.lock, pyproject.toml, uv.lock, tools/pdfjs/package.json, tools/pdfjs/package-lock.json, tools/verapdf.py, .github/workflows/, and the engine, tests, and Python sources that a new release requires changing.

Acceptance

• Each direct Rust dependency of the workspace and fuzz/ requires its newest release, on the prerelease line where the manifest already follows one.
• harfrust and skrifa use the read-fonts that hayro uses, so that Cargo.lock holds no copy of read-fonts for the engine alone.
• uv.lock and tools/pdfjs/package-lock.json hold the newest versions that their requirements allow, and the floors in pyproject.toml follow them.
• Each action pin names the commit of the newest release's tag, and the veraPDF digests match the jars on Maven Central.
• python3 tools/check.py --locked, cargo-audit audit --deny warnings, and actionlint pass.
• CI, Fuzz, Docs, and Windows pass on the current head.

Notes

• Already at the newest release: Rust 1.99.1, cargo-audit 0.22.2, actionlint 1.7.12, cargo-fuzz 0.13.2, and the Arlington model.
• release.yml runs only on tags and by hand, so a pull request does not exercise its new pins.
• The veraPDF update can change what tools/verapdf.py reports. A new rejection needs a fix or an entry in its REJECTED table with an issue.