chore: remove unused irma dependency

[dobby-coder]

irma 0.2.1 was declared in Cargo.toml but never imported anywhere in src/: no use irma, no irma:: path, nothing in build.rs. Removed it instead of migrating to irmars 0.2.2, per the audit note on the issue.

There is no IRMA client to migrate here. Attributes reach cryptify already signed inside the PostGuard-sealed file and are read back through pg-core's Unsealer at finalize; nothing in this service talks to a Yivi session server.

This drops cryptify's direct declaration only. pg-core 0.6.1 still depends on irma 0.2.1, so the crate is still compiled into the binary (cargo tree -i irma → irma v0.2.1 ← pg-core v0.6.1 ← cryptify), and it still brings reqwest 0.11.27 along with cryptify's own reqwest 0.13.4.

Local quality gate passes: cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo test --all-targets (151 passed).

Follow-up in another repo: postguard-e2e's compat/manifest.json carries a knownDrift entry for the cryptify/pg-pkg IRMA pair. Record it there as still present transitively, not resolved.

Closes #194
Part of encryption4all/postguard#247

[dobby-coder]

VERDICT: approve

Rule sweep + consolidated review, cycle 1. No blocking issues. The one finding carried forward from the review stage was a nit; I fixed it on the branch rather than sending the PR back.

The change is correct. git grep -i irma over the tree finds only unrelated string literals (irma-demo.sidn-pbdf.email.email in config.rs, a doc comment in email.rs) — no use irma, no irma::, nothing in build.rs. Removal was the right call over the irmars 0.2.2 migration the issue originally asked for, and it matches rubenhensen's audit note.

Nit, fixed in 57de8c5. The PR body and the new CLAUDE.md section said irma "stays in Cargo.lock", which reads as lockfile residue. It is not: cargo tree -i irma on this HEAD gives irma v0.2.1 ← pg-core v0.6.1 ← cryptify, the normal dependency edge, so irma 0.2.1 is still compiled into the shipped binary. It also brings reqwest 0.11.27 into the build alongside cryptify's own reqwest 0.13.4. Left as-is, that wording could lead the postguard-e2e knownDrift follow-up to record the cryptify/pg-pkg IRMA pair as resolved when the crate is still present. Reworded both.

Rule checks that came back clean: PR title passes the Conventional Commit job; Closes #194 registers in closingIssuesReferences; the cross-repo postguard#247 reference uses the full link form; rubenhensen is assigned as reviewer; CI is green on all five real jobs (fmt/clippy/test, both Docker builds, manifest).

Two Haiku candidates dropped as false positives: pr-review-assignments (a reviewer is in fact requested) and no-justification-paragraphs-for-simple-changes against the new CLAUDE.md section. The latter rule targets user-facing docs justifying a change; CLAUDE.md is the agent-notes file, and recording that cryptify has no IRMA client of its own is what stops a future audit re-filing #194.

Flipping out of draft.