chore(deps): move oxc to 0.151 and ruff to 0.0.15 as families

[kucherenko]

What

Replaces #1093, #1094, #1095 and #1096. All four were red for the same reason: Dependabot bumps one crate at a time, and oxc and ruff each publish a family of crates that share their types. oxc_span 0.150 next to oxc_parser 0.147 is two different SourceTypes, and the build fails with messages like

expected `oxc_ast::ast::SourceType`, found `oxc_span::SourceType`
expected `AstKind<'_>`, found a different `AstKind<'_>`
expected `&[Stmt]`, found `&ThinVec<Stmt>`

None of them could be fixed on its own branch — each needs the rest of its family to move with it. This PR moves each family as a whole:

• every oxc_* dependency to 0.151, in cpd-tokenizer and basta both
• ruff_python_ast and ruff_python_parser to 0.0.15, one past what Dependabot offered

Two copies of oxc

cpd-tokenizer was on oxc 0.147 and basta on 0.150, so the tree built two full copies of the parser, AST, semantic analyser and their helpers. It worked only because the two crates never pass oxc types to each other. Both are on 0.151 now and the lockfile holds one copy, 190 lines shorter. Nothing outside the two families changed version; owo-colors drops out because only the old oxc used it.

Code

One real API change: ParserReturn::panicked is now fatal_error, documented the same way — the parser gave up and the program is empty. Two call sites in cpd-tokenizer. The debug line that says OXC panicked stays: it reports a real panic caught by catch_unwind, not the field.

The &ThinVec<Stmt> error in #1094 was not an API break to work around. It came from ruff_python_parser 0.0.14 handing ruff_python_ast 0.0.13 its own types; with both on 0.0.15 the ThinVec derefs to a slice and basta compiles unchanged.

So it does not happen again

dependabot.yml groups the families, oxc* and ruff_*, so each future bump arrives as one PR.

Validation

• cargo test --workspace --locked: all 30 suites pass. fmt and clippy (-D warnings) clean.
• MSRV: cargo +1.96 check --workspace --locked passes on rustc 1.96.1. Every new version declares rust-version 1.96, the same as ours.
• Clone detection on fixtures/ against the released 5.3.2: 254 clones, 10200 duplicated lines, 172231 tokens, identical in every format. The parser moved four minor versions and tokenizes the corpus exactly as before.
• Dead code on every fixtures/dead-code-demo directory against 5.3.2: identical findings, including python/ (ruff), typescript/, components/ and frameworks/ (oxc_semantic), and rust/ from its committed diagnostics.

cpd-tokenizer changed code here, so the next release should bump it in sync-version.mjs. basta changed only its dependency versions and releases from its own repository.

---

This change is