build!: update dependencies to latest

[jrandolf]

Upgrades every workspace dependency that had a newer release.

Dependency bumps

Crate	From	To
buffa, buffa-build, buffa-codegen	0.7	0.8
connectrpc	0.7	0.8
syn	2	3
ulid	1	3
cel	0.13	0.14
prettyplease	0.2	0.3

Plus a cargo update pass on the lockfile.

buffa 0.9 is deliberately held back

buffa 0.9.1 is available, but connectrpc 0.8.1 still depends on buffa ^0.8.1. Taking 0.9 links two incompatible buffa versions into the same tree. Our own crates still compile (connect.rs only touches ConnectError), but the breakage lands on users: #[connect_impl] generates calls against connectrpc::ServiceRequest<'_, pb::Foo>, and a pb::Foo generated by buffa-build 0.9 does not satisfy bounds connectrpc wrote against buffa 0.8's Message trait.

Since connect is a default feature, shipping that combination would hand downstream users a broken default. This workspace moves to buffa 0.9 once connectrpc does.

Code changes from the upgrade

buffa 0.8 switched generated map fields from std::hash::RandomState to its own foldhash hasher. The conformance executor now builds into the response's own map field rather than naming std::collections::HashMap, so it stays correct regardless of which hasher buffa picks:

error[E0308]: expected `HashMap<String, TestResult, RandomState>`,
                 found `HashMap<String, TestResult>`
  = note: `std::hash::RandomState` and `buffa::foldhash::fast::RandomState`
          have similar names, but are actually distinct types

MSRV lowered to 1.88

Declared rust-version was 1.95, but that was well above the real floor. Bisected against this dependency set:

Toolchain	Result
1.87.0	fails — let-chains unstable in protovalidate-buffa-macros
1.88.0	compiles, 172/172 tests pass
1.89.0 / 1.92 / 1.95 / 1.97.1	pass

Lowered the declaration to 1.88 to match. Worth noting CI has no MSRV job, so nothing currently guards this — happy to add one if you want it enforced.

Unrelated fix riding along

cel::parse_duration's suffix chain tripped clippy's question_mark lint and has been failing CI on main since before this branch (run 29374258619). Rewrote it behind a split_unit helper so this PR can go green; suffix precedence is unchanged (ns/us/ms still win over bare s).

Docs

• Added a Compatibility section pinning the buffa / connectrpc / Rust versions and explaining the 0.9 hold.
• Corrected the "Why a different crate?" claim that buffa has "no dynamic-message reflection" — buffa now ships DescriptorPool / DynamicMessage under its reflect feature. Reworded to what actually distinguishes it: static generated types over descriptor-driven dynamic messages.

Verification

• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test --workspace --all-targets — 172 passed, 0 failed
• cargo tree -i buffa — resolves to a single version (0.8.1)
• cargo fmt --all -- --check — two pre-existing diffs in protoc-gen-protovalidate-buffa/tests/ untouched by this PR; they come from a local rustfmt version difference and CI's fmt job passes on them

https://claude.ai/code/session_013191mLJr4ZQxYX5qw2K5hn