build(deps): update hts-sys to 2.2.1 for bindgen 0.72 compatibility

[BenjaminDEMAILLE]

Fixes #129.

Problem

Cargo.lock pinned hts-sys 2.2.0, which requires bindgen ^0.69.4. That bindgen release mis-parses the htslib headers with current libclang (LLVM 20+), emitting sam_hdr_t and BGZF as opaque _address-only types. rust-htslib then fails to compile against its own generated bindings:

error[E0609]: no field `n_targets` on type `sam_hdr_t`
     = note: available field is: `_address`
...
error: could not compile `rust-htslib` (lib) due to 11 previous errors

This only shows up on toolchains with a recent libclang, so macOS (Command Line Tools libclang) builds fine while Linux CI with current LLVM fails. Distro packaging (Homebrew) builds the tagged tarball with --locked, so the pinned 2.2.0 is what gets compiled.

Fix

hts-sys 2.2.1 moved to bindgen ^0.72.1, which parses the headers correctly. rust-htslib 1.x already declares hts-sys ^2.2.0, so a lockfile refresh is sufficient — no manifest change:

cargo update --package hts-sys

Lockfile delta: hts-sys 2.2.0 -> 2.2.1, bindgen 0.69.5 -> 0.72.1, rustc-hash 1.1.0 -> 2.1.3, lazycell dropped.

Verification

• cargo build OK
• cargo test OK (all tests pass)

🤖 Generated with Claude Code

[ewels]

Thanks!

[BenjaminDEMAILLE]

The Security audit failure here is not caused by this PR — it reproduces on main and on every other open PR.

Crate:    crossbeam-epoch
Version:  0.9.18
Title:    Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared`
          when the underlying pointer is invalid
ID:       RUSTSEC-2026-0204
Solution: Upgrade to >=0.9.20

crossbeam-epoch is transitive via rayon → crossbeam-deque, and the advisory was published 2026-07-06, after this branch was cut.

Pushed cargo update --package crossbeam-epoch (0.9.18 → 0.9.20). It locks exactly one package and touches nothing else. Since this PR is already a lockfile-only dependency fix, it seemed the natural place for it rather than a separate PR — happy to split it out if you would rather keep the hts-sys change isolated.

Verified locally with cargo-audit 0.22.2:

warning: 3 allowed warnings found
EXIT=0

cargo test --release passes (200 + 12 + 18 + 2).

The three remaining findings are reported as allowed warnings and do not fail the job: number_prefix unmaintained (RUSTSEC-2025-0119), ttf-parser unmaintained via plotters (RUSTSEC-2026-0192), and the anyhow Error::downcast_mut() unsoundness (RUSTSEC-2026-0190). Worth a separate look at some point, but none of them are blocking CI.

---

🤖 Generated with Claude Code