chore: sync main into v1 (Rust 1.78 lockfile, actions bumps)

[eli-r-ph]

💡 Motivation and Context

Brings the 3 commits that landed on main since v1 forked into 1.0, so 1.0 doesn't drop them. Each one is cherry-picked with -x:

• fix: Preserve Rust 1.78 dependency compatibility #277: keeps the locked dependency graph on the Rust 1.78 minimum.
• chore(deps): bump the github-actions group with 4 updates #276 and chore(deps): bump the github-actions group with 2 updates #282: GitHub Actions bumps.

Adaptations to v1:

• ci.yaml: fix: Preserve Rust 1.78 dependency compatibility #277's two MSRV jobs are ported without --features capture-v1, because v1 removed that feature (V1 is the only path).
• transport.rs: both sides add the same #[allow(deprecated)], so v1's comment wording stays.
• Cargo.lock: drops the orphaned semver entry, because v1 removed that dependency. Every other package matches main.
• sdk-compliance-tests-v0.yml and -v1.yml: main bumps their harness pin, but v1 deleted both files and runs the harness from sdk-compliance-tests.yml, so they stay deleted.

Independent of #279 and #280: it merges cleanly with both.

💚 How did you test it?

• Reverse-applying main's whole diff since the fork: 66 of 69 hunks are present verbatim. The other 3 are the ci.yaml, transport.rs and Cargo.lock adaptations above.
• Merged with feat!: stop forcing person processing for groups; new_anon sets the option #279 and docs: explain that the sdk-info header sets $lib on 1.0 #280: fmt, clippy -D warnings, scripts/check-public-api.sh, the CI build and test matrix, cargo publish --dry-run --locked, and cargo +1.78.0 check --locked for the async and blocking clients pass locally.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran sampo add to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

• Cursor agent (Claude). The author chose a reviewable PR over pushing a merge to v1. Squash merges don't record merge history, so main still shows as unmerged. A no-content merge to record that history is planned for after the 1.0 PRs land.