feat(deps): add gamut as pinned git dependency and raise MSRV to 1.92

[justin13888]

Closes #17.

What is Delivered

• Pinned gamut dependency. [workspace.dependencies] gains gamut-core, pinned to an exact commit hash per the upstream-first policy in AGENTS.md — never a branch, never crates.io until gamut publishes. Crates are added lazily, as each migration issue starts consuming one, so the dependency list stays an accurate record of what rawshift actually uses.
• The dep is really built, not inert. An entry in [workspace.dependencies] that no member references is never fetched or compiled. gamut-core is therefore wired into rawshift-core, so CI genuinely resolves, fetches, and compiles the pin. It is consumed in code by the core-primitives migration (rawshift-core: replace generic primitives with gamut re-exports, keep sensor types #18).
• MSRV 1.90.0 → 1.92.0, the minimum gamut requires — tracking upstream per the README MSRV policy, not an independent raise. Applied to the workspace rust-version, rust-toolchain.toml, and all eight CI toolchain pins.
• Pin-bump procedure documented in a new README section: one commit that only moves the hash, confirmation the upstream gate landed, full test run, full benchmark run against the pre-bump baseline, and a CHANGELOG note for behavioural change.

Deviation from the issue text: the pin is b08a1a2, not 295c8924

The hash named in the issue predates four upstream gates that landed on gamut master on 2026-07-17/18:

gate	rawshift issue it unblocks
gamut#252, #262, #263 — gamut-ifd RAW-grade parsing + hardening audits	#20
gamut#28 — JPEG encoder/decoder	#31
gamut#249 — PNG decoder	#32
gamut#250 — AVIF container read + AV1 codestream handoff	#33

All four are closed and merged. Pinning to 295c8924 would leave those four issues blocked for no reason; b08a1a2 is what actually unblocks them. Verified independently that gamut-jpeg, gamut-png, gamut-avif, and gamut-ifd compile clean at this rev with zero todo!/unimplemented!.

One code change

Rust 1.92 reports unused_assignments against binrw's generated BinRead impl for RawIfdEntry/RawBigTiffIfdEntry. The is_little import is read — by every field's #[br(is_little = ...)] — but the expansion assigns the binding a placeholder before overwriting it. The lint fires inside the generated impl, which a struct-level attribute does not reach, so it is allowed at module scope in tiff/parser.rs. That module is deleted wholesale by the gamut-ifd migration (#20).

Verification Done

Run locally on the 1.92.0 toolchain this PR pins:

• cargo check --workspace — clean; Cargo.lock records gamut-core v2.0.0 from git+…?rev=b08a1a22, confirming the pin resolves and builds.
• cargo clippy --workspace --all-targets -- -D warnings — clean.
• cargo clippy -p rawshift-image --all-targets --features full -- -D warnings — clean. This is the check that caught the binrw lint; the default-feature clippy run passes without it, so full is the load-bearing gate here.
• cargo test --workspace — 372 passed, 0 failed (5 ignored, fixture-gated).
• cargo fmt --all -- --check — clean.
• lefthook pre-commit (fmt + clippy-fix + clippy + clippy-full + check-modified) — all green.

No behavioural change, so no CHANGELOG entry: this bump adds the dependency rather than moving an existing pin.