chore(deps): upgrade sha2 to 0.11

[juicyjusung]

Summary

• add a fixed SHA-256 characterization test for project IDs before changing the hash implementation dependency
• upgrade sha2 from 0.10 to 0.11 and refresh its transitive lockfile entries

Why

Project IDs select the persisted configuration directory. The golden test locks the existing /home/user/project → 9dad1e4e mapping so a dependency change cannot silently make existing preferences appear lost.

sha2 0.11 keeps the Sha256::new, update, and finalize APIs used by nr, supports Rust 1.85+, and removes the old generic-array dependency path.

Verification

• golden project ID test passes before and after the dependency update
• cargo fmt -- --check
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo test --all-targets --locked (201 tests passed)
• cargo +1.86.0 check --all-targets --locked
• cargo build --release --locked
• identical-base release builds measured 1,171,760 bytes before and 1,171,744 bytes after (-16 bytes; treated as neutral, not a performance claim)

Compatibility and user impact

The project ID output and persisted storage lookup remain unchanged. No CLI, package-manager, or file-format behavior changes.