chore(deps): update first-party cachekit to v0.2.1

deny.toml

@@ -73,17 +73,22 @@ deny = []
 # Skip specific dependencies from multiple-version checks
 # Format: { crate = "name@version", reason = "explanation" }
 skip = [
-    # windows-sys versions diverge across the ecosystem (0.60.x vs 0.61.x)
-    # Safe to allow: Windows FFI bindings, no runtime state, maintained by Microsoft
-    { crate = "windows-sys@0.60.2", reason = "Transitive dep version mismatch with 0.61.x" },
     # getrandom 0.2.x (ring) vs 0.3.x (newer ecosystem) - common split
     # Safe: stateless RNG interface, both maintained
     { crate = "getrandom@0.2.17", reason = "ring uses 0.2.x, newer deps use 0.3.x" },
 ]
 
 # Skip crate trees entirely (e.g., frequently-updated foundational crates)
 # Format: { crate = "name", reason = "explanation" }
-skip-tree = []
+skip-tree = [
+    # Windows FFI shim family (windows-sys -> windows-targets -> windows_x86_64_*) churns
+    # across majors (0.59/0.60/0.61) as transitive deps migrate. It is never compiled on the
+    # Linux CI target and only one variant is ever linked per platform, so duplicate versions
+    # are benign. skip-tree covers the whole subtree so a windows bump pulled in by a transitive
+    # build dep (e.g. cachekit-core's RNG path) does not re-trip the duplicate ban. (#175)
+    { crate = "windows-sys", reason = "Windows FFI shim; benign cross-major churn, not built on Linux" },
+    { crate = "windows-targets", reason = "windows-sys subtree; may also appear under other parents" },
+]
 
 # ═══════════════════════════════════════════════════════════════
 # SOURCES - Source Registry Policy

rust/fuzz/Cargo.toml

@@ -18,7 +18,7 @@ rmp-serde = "1"
 # not the thin PyO3 wrapper's flat re-exports.
 [dependencies.cachekit_storage]
 package = "cachekit-core"
-version = "=0.2.0"
+version = "=0.2.1"
 features = ["compression", "checksum", "messagepack", "encryption"]
 
 # Prevent this from interfering with normal build