chore: update crane, cargo deps, and dylint to 6.1.0, patching its driver for the removed --env-set

[mikeslade]

Routine update of the flake inputs, the rolling nightly, and the Cargo dependencies, plus the one fix the dependency bump forces.

What changed

• nix flake update: only crane moved (2026-08-03 → 2026-09-18). fix(lib): build on nightly-2026-09-27, and find a glob nested in a use list #10 already took nixpkgs and rust-overlay to today's snapshot, so the resolved toolchain stays nightly-2026-09-27.
• cargo update: 35 packages, including dylint_linting 6.0.2 → 6.1.0. Cargo.toml and the flake's dylintToolsVersion follow it, so cargo-dylint, dylint-link and the runtime driver are all 6.1.0.
• The dylint driver is patched in the flake. Remove experimental --env-set option rust-lang/rust#161831 (merged 2026-08-31) removed the unstable --env-set flag; dylint ≥ 6.0.3 passes it on every lint run to carry a state hash into rustc's incremental cache key, so on any newer nightly the driver dies with Unrecognized option: 'env-set' before linting anything. This is --env-set has been removed from rustc, breaking DYLINT_UNTRACKED_STATE trailofbits/dylint#2078, open and unfixed on master as of today. The patch stops passing the flag, which restores the 6.0.2 behaviour (a stale incremental cache is the caller's problem; the fixture checker already lints from a cold target dir). It is applied with --replace-fail, so the upstream fix will surface here as a build failure, which is the cue to drop it.
• One clippy redundant_closure in is_fallible_conversion_name's call site, so clippy is clean on this nightly.

Pinning dylint at 6.0.2 was the alternative; rejected because every later dylint release carries the flag, so the pin would have blocked all future dylint updates until upstream ships a replacement mechanism.

How verified

Command	Result
nix flake check	all 6 checks passed
nix develop -c cargo test	23 passed
nix develop -c cargo fmt --check	clean
nix develop -c cargo clippy --all-targets	clean
nix develop -c scripts/check-blocking-in-async-fixture.sh (driver cache cleared first, so the driver was rebuilt from the patched source)	OK: 11 expected blocking sites reported, and no others
fixture cargo dylint --all -- --workspace (README command)	26 SQLx, 5 inline-SQL, 2 wildcard-import, 1 file-length: identical to #10's run
Same command with the unpatched 6.1.0 driver	fails: Unrecognized option: 'env-set' on the driver's rustc -vV probe