chore(deps): refresh lock onto saorsa-core 0.26.3 (V2-623)

[jacderida]

Linear issue

• https://linear.app/autonominetwork/issue/V2-623 (log-based traffic accounting — the upstream saorsa-core work this lock refresh picks up)

Companion to WithAutonomi/ant-node#189, which bumps ant-node's direct
saorsa-core pin from 0.26.2 to 0.26.3. Raised for the 2026-07-28 release train.

Lock-only change — no manifest moves. ant-client has no direct saorsa-core
dependency by design; ant-core/Cargo.toml explicitly says not to add one, since
it arrives through ant-protocol's re-exports. So there is no pin to bump here,
only a resolution to refresh.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Client-only, and everything the bump carries upstream is observational (counters
and a periodic summary log line). Nothing changes what the client sends or accepts.

Compatibility

• Wire: none
• Storage: none
• API: none — no manifest or source change; only Cargo.lock

Semver impact

• breaking
• feature
• fix

Test evidence

• cargo check --all-targets --all-features — clean at this head (only the
  pre-existing proc-macro-error2 future-incompat warning). --all-features
  matters here because it enables devnet, which links ant-node 0.15.0 from
  the registry; that is the path where a saorsa-core version skew would surface
  as a MultiAddr type mismatch.
• Verified the graph resolves a single copy of each shared crate, which is
  the property ant-core/Cargo.toml's comments are protecting:
  saorsa-core 0.26.3 (1 copy), saorsa-transport 0.35.2, ant-protocol 2.3.0,
  ant-node 0.15.0.
• Refreshed with a targeted cargo update -p saorsa-core --precise 0.26.3, not a
  blanket update. Version changes: saorsa-core 0.26.2 → 0.26.3,
  saorsa-transport 0.35.1 → 0.35.2, unicode-width 0.2.0 → 0.2.2.
• Net 144 deletions against 15 insertions because transport 0.35.2 drops
  rustls-platform-verifier and with it the Android JNI and stale
  windows-sys 0.45 trees.

New dependency

none — this removes dependencies rather than adding any.

ADR

n/a — lock refresh; no ADR governs it. The upstream change is tracked in V2-623.

Mitigation / rollback

Revert the single commit to restore the previous Cargo.lock. Nothing persistent
changes and no manifest constraint was altered, so the revert is exact.

Why now rather than at release time

The existing constraints already permit 0.26.3 (^0.26.2 from both
ant-protocol 2.3.0 and ant-node 0.15.0), so this would eventually resolve
forward on its own when ant-core/ant-cli bump their ant-node pin to 0.16.0
at release. Doing it explicitly now keeps both repos on the same saorsa-core
patch going into the cut, instead of discovering a skew during RC verification.