fix(deps): crossbeam-epoch 0.9.20 for RUSTSEC-2026-0204

[noahgift]

RUSTSEC-2026-0204

crossbeam-epoch 0.9.18 → 0.9.20. Invalid pointer dereference in the fmt::Pointer impl for Atomic/Shared. Patch-level lockfile bump.

⚠️ This PR carries more than that — and here's why

While landing the bump, the local pre-push gate turned out to be structurally unpassable:

Check	State
cargo test --lib	errors: no library targets found in package cohete — this crate is bin-only, so it could never pass
cargo fmt --all --check	84 diffs across all 9 source files
cargo clippy -- -D warnings	2 errors

A gate that cannot pass is worse than no gate: every push had to use --no-verify, so nothing was ever enforced — which is exactly how the unformatted code and the clippy errors accumulated behind it.

Fixed here:

• clippy: map(..).unwrap_or(false) → is_ok_and (runner.rs); three truncating usize as u32 casts → u32::try_from (benches/); dropped a redundant use serde_json;
• rustfmt applied across all 9 files

The hook itself lives in .git/hooks (untracked, so this PR can't carry it). Locally it now runs cargo test instead of cargo test --lib, so it works on a bin-only crate, and prints failure output instead of a bare ❌.

Verification

format, cargo check, clippy -D warnings and tests all pass — the gate is green here for the first time — and cargo audit no longer reports 0204.

Related

Also found: all three of this repo's scheduled workflows were in disabled_inactivity (GitHub's 60-day auto-disable), unnoticed for ~4 months because cohete was outside the fleet lane-liveness scope. Nightly and Nightly Benchmarks are re-enabled; Nightly E2E needs the offline Jetson. See paiml/infra#167 and PMAT-202.

🤖 Generated with Claude Code

[noahgift]

⛔ Blocked on paiml/.github#44

All three red checks — ci / test, ci / coverage, and ci / gate (which aggregates them) — are the same upstream defect, not anything in this PR:

error: process didn't exit successfully: `cargo test ... --lib` (exit status: 101)
error: no library targets found in package `cohete`

sovereign-ci.yml passes --lib on every branch of its test and coverage fallback chains, and cargo test --lib errors rather than fails on a crate with no [lib]. cohete is bin-only, so it has no reachable configuration — test_workspace only toggles --workspace, and both values keep --lib.

paiml/.github#44 appends one --lib-free link to each chain (purely additive — crates that have a lib never reach it). These checks should go green once it merges; nothing further is needed here.

Worth noting the symmetry: the same --lib assumption made this repo's local pre-push hook unpassable, which is how the 84 rustfmt diffs and 2 clippy errors fixed in this PR accumulated in the first place.