fix: harden codec validation and benchmarks

[Liona-orph]

Summary

• prevent overflow in capacity hints parsed from corrupted headers and add a regression test
• remove avoidable allocations and stale lint patterns in diagnostics, encoding tests, and storage tests
• update the benchmark stack to Criterion 0.7, replacing deprecated criterion::black_box and removing the RustSec warning from atty

Validation

• make ci with Rust 1.83.0
• cargo audit