chore(ci): repin fleet-ci to the revision that gates the unsafe lint

[h4x0r]

Moves this repo from 9234e1fa to 85c7263.

Unsafe lint audit — a new job inside the gate

It asserts that every workspace member effectively forbids or denies unsafe_code, which is the part the compiler cannot tell you. Cargo does not apply workspace lints implicitly:

• a member with no [lints] table does not inherit them
• a member with its own [lints] table replaces inheritance rather than extending it

Either way the crate compiles with unsafe permitted while the workspace root still reads compliant. Surveying the root scores such a repo green — which is how five published crates across two repos went unnoticed until this check existed.

It replaces the Unsafe Audit (cargo-geiger) job that eighteen repos carried as a sibling of the shared-workflow call. That job could not fail (|| true on the step, continue-on-error on the job), and being a sibling rather than a job inside the reusable workflow, ci / All checks never reached it and branch protection never required it.

Coverage inputs

coverage-metric (lines | functions | both) and coverage-include-regex let a repo gate on functions, or hold one published path at 100% while the rest carries tracked debt. Both default to today's behaviour, so this repo's coverage posture is unchanged unless it opts in.

Expected result

Green. The whole fleet already passes the unsafe audit — that was verified across all 92 repos with manifests before this sweep began.

Also in this revision

Every job now carries timeout-minutes, and apt-get update is retried behind a 300s timeout. Nothing had a ceiling before: a hung apt consumed GitHub's full six-hour job limit across six repos yesterday and produced a red gate that looked like a code failure. A new job-timeout-minutes input (default 45) lets a heavy repo raise the ceiling rather than remove it.