chore: fix new clippy lints, update lockfiles, extend dependabot

[dignifiedquire]

Summary

CI on main fails under Rust 1.98, because newer Clippy lints error out under -D warnings. The same failure caused Dependabot PRs #30–#33 to fail. This PR fixes the lints, updates every lockfile in the repository, and extends Dependabot to the lockfiles it was missing.

Commit 1: fix new clippy lints

• needless_late_init (4 sites in sonora-aec3): echo_audibility.rs, matched_filter_lag_aggregator.rs, and two in residual_echo_estimator.rs. Each is now an if expression. The upstream branch structure is unchanged, and the change does not affect behavior.
• chunks_exact_to_as_chunks (2 test helpers in sonora-agc2/src/rnn_vad/): both now use slice::as_chunks::<4>(). It has been stable since Rust 1.88, which is within our 1.91 minimum.

Commit 2: update lockfiles

Runs cargo update for the workspace and the three excluded manifests. All updates are semver-compatible, and no manifest changes.

Lockfile	Packages	Notes
Cargo.lock	42	Resolved for Rust 1.91. Includes clap 4.6.7, ringbuf 0.5.2, cpufeatures 0.3.1, and cpal 0.18.2 (the contents of #30–#33).
crates/sonora-sys/Cargo.lock	22	Fixes RUSTSEC-2026-0202 (cxx 1.0.194 → 1.0.202).
crates/sonora-bench/Cargo.lock	71	Fixes RUSTSEC-2026-0204 (crossbeam-epoch 0.9.18 → 0.9.21, via criterion).
fuzz/Cargo.lock	48	None.

Both advisories affect only unpublished, dev-only crates.

Verification (local, aarch64-apple-darwin, rustc 1.98)

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p sonora --all-targets --features examples -- -D warnings
• cargo test --workspace: 760 passed, 0 failed, 0 ignored
• cargo +1.91.1 check --workspace --all-targets (MSRV)
• RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps
• cargo deny check advisories on all four lockfiles
• cargo check for sonora-bench + sonora-sys (against the local C++ install) and fuzz
• Not run locally: cross (Android/iOS), Windows, C++ validation, coverage. CI covers these.

Commit 3: Dependabot coverage for the excluded manifests

.github/dependabot.yml now has weekly cargo entries for /fuzz, /crates/sonora-sys, and /crates/sonora-bench. These directories are excluded from the workspace and have their own Cargo.lock, so the root entry never updated them. That gap let both advisories above go unnoticed. The YAML parses, and each directory has its own Cargo.toml and Cargo.lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H29DamSLugosGXJSz1e5Yx

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 85.71429% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.64%. Comparing base (a024d6e) to head (fd06285).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #35   +/-   ##
=======================================
  Coverage   93.64%   93.64%           
=======================================
  Files         146      146           
  Lines       31132    31130    -2     
  Branches    31132    31130    -2     
=======================================
- Hits        29154    29153    -1     
+ Misses       1754     1753    -1     
  Partials      224      224           

Flag	Coverage Δ
rust	93.64% <85.71%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.