docs: record dependency decisions in DEPENDENCIES.md

[BenjaminDEMAILLE]

Closes #209.

CONTRIBUTING.md requires a new dependency to be raised in an issue before the PR. That covers the decision. The record was missing: justifications lived in Cargo.toml comments, and rejections lived nowhere, so a crate turned down in August gets re-proposed in February and re-argued from scratch.

Four sections rather than the three the issue proposed:

1. Runtime dependencies — crate, version, license, the files that import it, and why it earns its place.
2. Dev-only dependencies — same shape, lower bar.
3. Considered and declined — from the August 2026 survey (Dependency survey (Aug 2026): umbrella for the crate evaluations #201), with the reason and the deciding issue.
4. Under evaluation — the open threads (Dependency discussion: sufr/libsufr for suffix-array construction (vs the caps-sa incumbent) #202, Dependency discussion: libsais (vendored C via cc) for suffix-array construction #162, Dependency discussion: portable SIMD crate (wide/pulp) vs the hand-rolled intrinsics in simd_scan.rs #205, Dependency discussion: interval-overlap crates (superintervals / coitrees / rust-lapper) #208, Read other compressed input formats (bz2 / zstd / xz): evaluate niffler #218, Dependency discussion: optional rapidgzip feature for parallel gzip input #224, New Dependency: hyalite for CR4 #197). This one is not in the issue's plan, and it is the section that does the most work: without it, an open evaluation reads as either an acceptance or a rejection depending on who is looking, and the next proposal opens a fresh thread instead of landing on the existing one.

Checked, not recalled

Licenses and versions are the resolved ones from cargo metadata. Every "used by" entry names a file that actually imports the crate, verified by grep, and a script confirmed every path in the file exists. That caught four rows I had written from memory: flate2 is used by solo/whitelist.rs, solo/count.rs and bin/emptydrops.rs rather than "quant/", rayon by index/sa_build.rs among others, noodles by bam_dedup.rs and wasp/mod.rs, and predicates by exactly one test.

Also in this PR, per the issue's checklist

• The Cargo.toml comments for the zlib-rs backend and for mimalloc are trimmed to a summary plus a pointer, so the long form lives in one place.
• CONTRIBUTING.md links the file next to the rule it serves.

Documentation only: no code changes, and cargo build and the parameter tests are green.

🤖 Generated with Claude Code