fix(ci): make MSRV real — raise to Rust 1.88 and actually test on it

[tupe12334]

Summary

The declared MSRV (Rust 1.75) was not real. 1.75 cannot build main:

• Cargo.lock is lockfile v4, which Cargo 1.75 can't read.
• toml 1.1 and serde_spanned 1.1 are edition 2024 (needs 1.85). Cargo 1.84 fails with failed to download serde_spanned v1.1.1.
• regress 0.11.1 uses let-chains (stable in 1.88) and doesn't declare a rust-version. Rust 1.85 through 1.87 fail with error[E0658]: `let` expressions in this position are unstable.

The MSRV (1.75) job still passed because rust-toolchain.toml pins stable, which overrides the toolchain the job installs. So it was just a second stable build.

Changes:

• rust-version = "1.88". I checked locally: 1.87 fails to build, and 1.88 builds and passes the full test suite with --locked.
• MSRV job:
  • Installs the toolchain via dtolnay/rust-toolchain@master with a toolchain: "1.88" input, instead of the @1.75 ref. Dependabot reads @1.xx as an action version; that is why chore: bump dtolnay/rust-toolchain from 1.75 to 1.120 #204 wants to "bump" it to @1.120. This PR makes chore: bump dtolnay/rust-toolchain from 1.75 to 1.120 #204 obsolete.
  • Runs cargo +1.88 test --locked. The +1.88 overrides rust-toolchain.toml, and it now runs tests, not just a build.
• README MSRV badge and CHANGELOG updated.
• Lint ratchet: clippy::trivially_copy_pass_by_ref is now deny (no existing violations).

Branch protection on main has no required checks, so renaming the job doesn't block anything.

Test plan

• cargo +1.88 test --locked passes (112 lib, 31 bin, 17 cli, 11 integration)
• cargo +1.87 build --locked fails (confirms 1.88 is the real floor)
• cargo clippy --all-targets --locked -- -D warnings passes (clippy's MSRV-aware lints now use 1.88)
• cargo fmt -- --check passes
• CI MSRV (1.88) job is green and its log shows rustc 1.88.0 running cargo +1.88 test --locked

🤖 Generated with Claude Code