chore: bring dependencies up to the latest versions

[tgockel]

Bump rmcp 1.8 -> 2.2 and rig-core 0.39 -> 0.40 (the two upgrades with breaking API changes) plus routine patch/minor bumps (anyhow, ignore, jiff, rand, toml/toml_edit) and a full Cargo.lock refresh.

rmcp 2.x realigned its content model to the 2025-11-25 MCP spec: the Annotated wrapper collapsed into a flat, #[non_exhaustive] ContentBlock enum. The proxy, client, and self-server match on ContentBlock directly, with wildcard arms for the non-exhaustive enums.

rig-core 0.40 replaced the two-method PromptHook with a unified AgentHook::on_event(StepEvent), dropped ToolDyn::definition for sync description()/parameters(), and renamed the prompt-builder setters. The tool-call tracer is ported onto on_event and narrows observes() to stay off the per-token streaming delta path.

max_turns now counts total model calls rather than tool-call rounds, so the rig-side backstop is passed tool_call_max + 2 to preserve the prior allowance; outrig's per-turn hook remains the limiter that fires first, so the observable tool-call ceiling is unchanged.

candle-core, hf-hub, and regex are held on purpose: mistralrs-core 0.8.1 (already the latest) requires candle-core ^0.10.2 and hf-hub ^0.4.3, and its serde-saphyr dep caps regex below 1.13.

Summary

What does this change, and why?

Checklist

• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets -- -D warnings is clean
• cargo test --workspace passes
• Docs in doc/ updated if behavior changed (mdbook build still clean)
• CHANGELOG updated for user-visible changes

Notes for reviewers

Anything worth calling out -- tricky bits, follow-ups, or intentionally out-of-scope items.