build(deps): metrics-exporter-prometheus 0.16 is two minor lines behind; upgrade needs a rig-quantified pass

What

The Prometheus exporter stack is two minor lines behind: metrics-exporter-prometheus 0.16.2 (latest 0.18.3), which pins metrics-util 0.19.1. This surfaced in the dependency-hygiene audit as the holder of three duplicate-version groups (rand 0.9, hashbrown 0.15, thiserror 1 via the exporter), and as an outdated version of a performance-sensitive dependency.

Why this is not a drive-by upgrade

• metrics-util is the hot-path metrics registry (per-request record() path); an upgrade can move per-request cost in either direction and must be quantified on the benchmark rig (same-rig A/B, saturation grid) before landing.
• The exporter renders the /metrics text exposition; an upgrade must pass the series-diff harness byte-identically (or any diff must be explicitly reviewed as a rendering change, not a data change).

Suggested acceptance

• Same-rig A/B within the noise gate (±5%), fail=0
• Series-diff harness: zero unexplained diffs against the same traffic
• Duplicate groups rand 0.9.x and hashbrown 0.15.x collapse or shift as expected

No behavior or performance numbers are claimed here; this issue only records the version gap and the gate it must pass.

Start by locating the dependency configuration and the metrics-exporter-prometheus integration, then review the benchmark rig and series-diff harness used for the exporter’s /metrics output. Upgrade the exporter and its metrics-util dependency, run the same-rig A/B saturation grid and series-diff checks, and confirm the duplicate dependency groups change as expected with no unexplained diffs.