fix(deps)!: upgrade candle to remove vulnerable zip

## Problem

`RUSTSEC-2026-0429` affects `zip 7.4.0`, which reaches the optional
`sentence-transformers` feature through `candle-core 0.9.2`. The `deny` check on
`main` fails on this advisory.

## Change

Update `candle-core`, `candle-nn`, and `candle-transformers` to `0.11.1`. The
focused lockfile resolution replaces `zip 7.4.0` with `zip 9.2.2`, and no other
zip version remains in the all-features graph. This also pulls candle's required
newer transitive `tokenizers` and `safetensors` releases; the directly declared
`tokenizers 0.19.1` and the embedding implementation remain unchanged.

The optional `sentence-transformers` Rust API exposes this dependency version:
`SentenceTransformersEmbeddingsBuilder::device` accepts
`D: Into<candle_core::Device>`, and the `Device` type is now from candle-core
0.11. The default CPU path constructs that device internally and is unchanged.

`deny.toml` is unchanged. Its obsolete zip ignores now produce
`advisory-not-detected` warnings, which do not fail the check.

## Validation

- The `sentence-transformers` feature builds with tests and examples.
- The existing CPU example loads the default model and retrieves
  `The human body has 206 bones.` for the matching query.
- A local contract check verified 384-dimensional, finite, non-zero Float32
  output and higher similarity for the matching fact than for an unrelated fact.
  It was not committed because it would add an 88 MB model download to
  all-features CI.
- `cargo deny` `0.20.2`, the version used by the Rust workflow, passes
  `advisories`, `bans`, `licenses`, and `sources`.
- The locally installed `cargo-deny 0.18.9` is not green: it treats
  informational unsound advisories differently from the workflow's `0.20.2`.
  The result above uses the exact CI version.
- Targeted clippy, formatting, lockfile review, and the reverse `zip` dependency
  tree pass.
- Hosted CI completed successfully for exact head `bffbcda6490fa1ed51838b3801e01ae2f82faed6`.

CI mitigation: Reclaim completed lancedb CI-profile artifacts before the Blob v2 example after disk sampling showed a minimum of 24,764,416 available bytes. This may rebuild lancedb for the example; the exact OS cause of the SIGBUS remains unproven.

BREAKING CHANGE: The optional `sentence-transformers` Rust API now takes
`candle_core::Device` from candle-core 0.11. Downstream crates that explicitly
construct and pass a candle-core 0.9 `Device` to
`SentenceTransformersEmbeddingsBuilder::device` must use a `Device` from
candle-core 0.11.x aligned with lancedb. This normally means updating a direct
candle-core dependency; if the value comes through a re-export, update the
dependency that supplies it. Callers that use the default CPU path without
passing a `Device` do not need to migrate.

.github/workflows/rust.yml

@@ -228,7 +228,11 @@ jobs:
         # Python and TypeScript blob docs tests install preview packages.
         # Those builds are not guaranteed to remain available for more than
         # 6 months, so they stay a manual run. This example uses the workspace crate.
-        run: cargo run --profile ci --all-features -p lancedb-blob-v2-docs --example multimodal --locked
+        run: |
+          # The completed all-features checks leave large lancedb artifacts in target.
+          # Reclaim that package before building the example with a different feature set.
+          cargo clean --profile ci -p lancedb
+          cargo run --profile ci --all-features -p lancedb-blob-v2-docs --example multimodal --locked
 
   remote:
     timeout-minutes: 30