[zmanian]

Summary

• update crypto-bigint from 0.7.5 to 0.7.6 in the workspace and both fuzz lockfiles
• update the corresponding ctutils dependency from 0.4.2 to 0.4.5
• raise the workspace MSRV from Rust 1.85 to 1.87, the minimum required by the patched crates
• update the existing cargo-vet exemptions and unreleased MSRV documentation

This is a focused mitigation for RUSTSEC-2026-0387 and RUSTSEC-2026-0385. It leaves source APIs and CI coverage unchanged.

PR #648 also contains these updates as part of a broader dependency refresh. This PR is offered as a narrow alternative with a smaller review surface and a lower MSRV increase.

Verification

• cargo +1.87.0 check --workspace --locked
• cargo +1.87.0 test --workspace --locked
• strict Rust 1.87 clippy using the existing CI feature matrix
• cargo +1.87.0 fmt --all -- --check
• both fuzz workspaces checked with RUSTFLAGS='--cfg fuzzing'
• cargo vet --locked: 109 fully audited, 26 partially audited, 247 exempted
• cargo tree --locked -i crypto-bigint resolves only crypto-bigint 0.7.6
• all three lockfiles no longer report RUSTSEC-2026-0387

The root audit still reports unrelated pre-existing advisories in quick-xml, rsa, and zip; the two fuzz lockfiles audit cleanly.