chore(deps): raise the pco floor to 1.0.3

[joseph-isaacs]

Summary

The workspace declares pco = "1.0.1", but the caret requirement means Cargo.lock has resolved 1.0.3 since it was published — every build and CI run already compiles against 1.0.3. This raises the declared floor to match what is actually built and tested, so the manifest stops advertising support for a version nothing exercises.

1.0.2 and 1.0.3 harden the decoder against corrupt and hostile input: upstream added a mutation-based test suite (src/tests/corruption.rs) covering single-bit flips and headers whose declared sizes are not backed by any data, with the contract that the decoder returns a PcoError rather than panicking or allocating on an unearned length. Vortex decodes Pco blocks straight out of files it does not control, so that floor is worth stating rather than leaving to lockfile resolution.

Split out of #9582 so the dependency change lands on its own; #9582 is now stacked on this branch and carries the 8-bit ptype support.

Changes

• Cargo.toml: pco = "1.0.1" → pco = "1.0.3".

Cargo.lock is unchanged — it already points at 1.0.3, so this is a no-op for the resolved dependency graph and cannot change compressed output.

Checks: cargo check -p vortex-pco --all-features, and cargo test -p vortex-pco -p vortex-btrblocks --all-features (all pass) on the stacked branch.

---

Generated by Claude Code

[codspeed-hq]

Merging this PR will degrade performance by 11.38%

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

❌ 1 regressed benchmark
✅ 1980 untouched benchmarks
⏩ 54 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	cold_misaligned[(16, 64)]	380.2 µs	429.1 µs	-11.38%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing claude/pco-bump-1.0.3 (acfdede) with develop (e4b3421)}

Footnotes

1. 54 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[AdamGS]

downstream users will also resolve to 1.0.3 (or higher), this sort of change seem like a never-ending race

[AdamGS]

downstream users will also resolve to 1.0.3 (or higher), this sort of change seem like a never-ending race

[joseph-isaacs]

We want pco u8/i8