Update dependencies, September 2026

[yaroslav]

• magnus 0.8.2 → 0.9.0, with default features off. In 0.9 old-api gates the old global-state API itself, and inkmark only uses the &Ruby handle API, so disabling it turns any future old-API call into a compile error. io is unused.
• Semver-compatible Cargo.lock and Gemfile.lock bumps (markly 0.19, rdoc 8.0, lefthook 2.1.14, Bundler 4.0.21, and more). rubocop, rubocop-performance, json and diff-lcs stay pinned by the latest standard and rspec.
• actions/checkout v6 → v7. Its only breaking change affects pull_request_target / workflow_run, which these workflows don't use.
• Fixed all clippy warnings. build_section_hash got a small ContentOptions refactor rather than an #[allow].