Demo improvements - #1

* ⬆️ chore(deps): upgrade all dependencies to latest majors

Bump every dependency to its latest released major. 16 of 21 direct deps
were already on the latest major; 5 needed incompatible bumps:

- opentelemetry        0.31 -> 0.32
- opentelemetry_sdk    0.31 -> 0.32  (clears Dependabot alert #1)
- opentelemetry-otlp   0.31 -> 0.32
- tracing-opentelemetry 0.32 -> 0.33
- sha2                 0.10 -> 0.11

No source changes were required. The observability setup already used the
post-0.30 opentelemetry API (SdkTracerProvider, Resource::builder_empty,
with_batch_exporter), which 0.32 kept stable, and the sha2 0.11 bump keeps
the Digest/Sha256 trait surface used in identity.rs.

cargo update also pulled transitive fixes:

- rustls-webpki 0.103.11 -> 0.103.13  (RUSTSEC-2026-0098/0099/0104)
- anyhow        1.0.102  -> 1.0.104   (RUSTSEC-2026-0190 unsoundness)

cargo audit goes from 3 vulnerabilities to 0.

Verified on aarch64-linux (tss-esapi-sys has no aarch64-darwin bindings):
cargo build, cargo build --release --locked, and cargo test all pass,
24/24 tests green including the swtpm-backed TPM signing test.

* 🧹 fix(sidecar): use infallible KeyHandle conversion

`ObjectHandle` -> `KeyHandle` cannot fail, so `try_from` plus an
`anyhow::Context` wrapper was dead error handling. clippy's
`unnecessary_fallible_conversions` lint made this a hard error under
`-D warnings`, which this crate escalates further via `pedantic = "deny"`.

Pre-existing on main; left out of the dependency commit to keep that
diff scoped to dependencies.

Verified on aarch64-linux (rust:1.94-trixie with libtss2-dev, swtpm,
tpm2-tools) because tss-esapi-sys ships no aarch64-darwin bindings:
  cargo clippy --all-targets -- -D warnings   exit 0
  cargo test                                  24 passed, 0 failed