fix(mounts): post-merge fmt + audit + minimal lockfile

- rustfmt the integration-test FolderService::new callsites added during
  the upstream merge (long single-line args wrapped).
- Cargo.lock: rebuild from upstream/main's lock so only the
  testcontainers-modules dev-dep subtree and the memmap2 0.9.10→0.9.11
  security bump differ (avoids churning upstream's pins).
- .cargo/audit.toml: ignore the four astral-tokio-tar tar-extraction
  advisories — dev-only, transitive via testcontainers-modules
  (integration-test harness), never in the production binary.

.cargo/audit.toml

@@ -39,4 +39,20 @@ ignore = [
     #   RUSTSEC-2026-0194: quadratic dup-attribute check → CPU-DoS
     "RUSTSEC-2026-0195",
     "RUSTSEC-2026-0194",
+
+    # astral-tokio-tar 0.5.6 — tar extraction advisories, transitive via
+    # testcontainers → testcontainers-modules, a DEV-dependency used only by
+    # the `--cfg integration_tests` harness to spin up throwaway Postgres
+    # containers. Never compiled into the production binary and never fed
+    # attacker-controlled tar input — the only archives extracted are the
+    # official Postgres images the test harness pulls. testcontainers 0.25.2
+    # pins astral-tokio-tar to ^0.5, so the fixed 0.6.x is not reachable
+    # without a testcontainers major bump (tracked separately).
+    #   RUSTSEC-2026-0145 / -0112: PAX header desynchronization
+    #   RUSTSEC-2026-0113: unpack_in symlink-following chmod
+    #   RUSTSEC-2026-0066: insufficient PAX extension validation (low)
+    "RUSTSEC-2026-0145",
+    "RUSTSEC-2026-0112",
+    "RUSTSEC-2026-0113",
+    "RUSTSEC-2026-0066",
 ]