chore(deps): bump dig-store to 0.5.1 and dig-merkle to 0.4.5

[MichaelTaylor3d]

What changed

Bumps this repo's dig-* crates.io dependencies to their latest published versions. Two of the
five drifted pins land here; the other three are blocked on an upstream dig-store release and
are deliberately not half-applied — evidence below.

Landed

Dep	Old	New	How
dig-store	0.5.0	0.5.1	lock only — digstore-cli/Cargo.toml:49 already pins "0.5", which admits 0.5.1
dig-merkle	0.4.3	0.4.5	lock only, transitive via dig-store (its ^0.4.3 bound does not admit 0.5.0)

No manifest edit was needed for either; both are pure re-locks. Workspace version 0.23.0 ->
0.23.1 (patch: dependency patch bumps only, no public API change).

Not landed — blocked upstream on dig-store

Dep	Pin	Latest	Blocker
dig-wallet-backend	0.4	0.27.0	chia generation (below)
dig-constants	0.5	0.10.0	chia generation (below)
dig-chainsource-interface	0.1	0.3.0	dig-store 0.5.1 requires ^0.1

All three moved to chia-protocol 0.36.1 / chia-wallet-sdk 0.34 / clvmr 0.16.2. This repo is on
chia 0.26 / chia-wallet-sdk 0.30 / clvmr 0.14. Those generations are semver-incompatible, so
cargo links both copies and the boundary types stop matching (chia_protocol::Coin,
BytesImpl<32>, CoinSpend).

What I verified (not assumed)

I took the full chia 0.26 -> 0.36.1 migration to completion locally to find where it actually
stops, rather than declaring it blocked on inspection. Findings, in case a follow-up lane picks
this up:

The migration is tractable and mostly mechanical.

1. datalayer-driver is not a blocker — 4.0.0 is published against chia-protocol 0.36.1 /
   chia-wallet-sdk 0.34 / clvmr 0.16.2.
2. The umbrella chia crate publishes no 0.36.x (versions jump 0.32.0 -> 0.42.0). It must be
   replaced by its constituents at 0.36.1: chia-puzzle-types, chia-bls, chia-secp,
   clvm-utils, chia-consensus. That is a mechanical path rewrite across 15 files
   (chia::puzzles:: -> chia_puzzle_types::, chia::consensus:: -> chia_consensus::, etc.).
3. After the version bump the whole workspace produced only 9 real API breaks, all fixed:
   • chia-sdk-coinset 0.34 added a trailing cursor: Option<String> to every
     get_coin_records_* method (5 call sites in digstore-chain/src/coinset.rs).
   • PushTxResponse::status became Option<String>.
   • chia-sdk-driver 0.34 removed Cat::issue_with_coin; Cat::single_issuance(ctx, parent, None, amount, conds) is the equivalent (2 test call sites).
   • chia-consensus 0.36 dropped run_spendbundle's height parameter. Worth flagging:
     rustc's suggested fix is to delete the 0 argument, which silently passes HEIGHT
     (6_000_000) as the flags bitfield and measures a different cost model. The faithful port is
     to reproduce what 0.26 did internally —
     get_flags_for_height_and_constants(height, constants) | flags | MEMPOOL_MODE.
4. With those fixed, digstore-chain compiles clean on the new generation.

Where it genuinely stops. dig-store 0.5.1 (the latest release) still requires
dig-chainsource-interface ^0.1, whose ChainSource trait is typed against chia-protocol 0.26.
digstore-cli cannot stay on 0.26 to match it — it is welded to digstore-chain and holding it
back produces 105 cross-generation type errors across ops/ and commands/. So
dig_store::get_store_status becomes uncallable and commands/store_status.rs fails with 6
errors:

error[E0277]: the trait bound `CoinsetChainSource<Coinset>: dig_store::ChainSource` is not satisfied
  note: there are multiple different versions of crate `dig_chainsource_interface`
error[E0308]: mismatched types: expected `chia_protocol::bytes::BytesImpl<32>`, found `BytesImpl<32>`

Bridging that by hand would mean byte-level conversion of Coin/CoinSpend/Bytes32 between two
chia generations inside the money-critical store-status lineage path. That is not a conversion I
am willing to hand-roll, and it is not what the ecosystem's release-first rule asks for.

Unblocking step (upstream, not this repo): release dig-store against
dig-chainsource-interface ^0.3 + chia-protocol 0.36.1. Once that is on crates.io, the three
remaining bumps land together with the migration above.

Test result

Full workspace suite on the locked tree: cargo test --workspace --locked

167 suites, 1544 passed, 0 failed, 17 ignored (13 doctest suites included). Cargo exit 0.

Guest wasm built first (cargo build -p digstore-guest --target wasm32-unknown-unknown --release)
per the digstore-stage build.rs BINDING contract.

Also green: cargo fmt --all --check, and cargo clippy --workspace --all-targets --locked
with the CI lint set.

Blast radius

Lock-only dependency movement plus a workspace patch version. No source file changed, so no call
site moved. crates/dig-client-wasm is workspace-excluded and has path dependencies only —
nothing to bump there.