bridge: pin alleycat crates to the 0xSero production main

[0xSero]

Purpose

Unblocks #307, #331, and #189: those PRs pin alleycat forks because the production lineage Litter ships from lived only on dnakov/alleycat@417f2a9 (release/litter-mobile-v1.6-base). That lineage is now reconciled into 0xSero/alleycat main (alleycat#51) and extended with the opencode conversation-pagination fix (alleycat#49), so Litter can track the fork's main directly.

Key changes

• shared/rust-bridge/Cargo.toml: alleycat-bridge-core / alleycat-pi-bridge / alleycat-claude-bridge / alleycat-opencode-bridge move from dnakov/alleycat@417f2a9 to 0xSero/alleycat@3fa1f194.
• services/kittylitter/Cargo.toml: alleycat same move. Note the scale: alleycat's own root manifest bumped iroh 0.98 → 1.0.3, so kittylitter's lock also moves iroh/iroh-base/iroh-relay/iroh-dns, noq 0.18 → 1.3, netwatch, portmapper, hickory, ed25519/curve25519-dalek to stable, lru 0.16 → 0.18, and simple-dns 0.9 → 0.12. That is the daemon's own dependency generation, not lock drift; it needs a Play/TestFlight-adjacent QA pass on the daemon (local studio + pairing) before the next release.
• Both Cargo.locks updated; kittylitter bumped 0.3.6 → 0.3.7 per check-kittylitter-release-version.sh.
• tools/scripts/update-alleycat-main.sh + docs updated to recognize the new pin location (review follow-up).

Verification

• cargo check in shared/rust-bridge: clean (full workspace incl. patched codex submodule).
• cargo check + tests in services/kittylitter: clean.
• Full cargo test run results posted as CI finishes.

Follow-ups enabled

After this merges: rebase/merge #307 and #331 onto this pin (they carry fork pins), and disposition #189.

[skip mobile-release]

[0xSero]

CI's kittylitter release-version gate flagged that services/kittylitter changed after v0.3.6, so this PR also bumps kittylitter to 0.3.7 (mechanical compliance with check-kittylitter-release-version.sh).

[0xSero]

Closing as superseded — main moved past this PR's premise today:

• Pins: main's alleycat pins now live on the makyinmars lineage (5dd425f2) via fix(thread): keep metadata thread reads paginated #307, which landed the daemon-side fixes (native-message cursor pagination, idle/active status, metadata-read pagination) that merged mobile code depends on. Re-pinning to 0xSero/alleycat@3fa1f194 now would move the daemon backwards (that rev diverged: 43 commits ahead of the makyinmars lineage, 18 behind — neither contains the other), so the repin can't merge without regressing fix(thread): keep metadata thread reads paginated #307's behavior. If the 0xSero fork should become the production lineage again, it needs to absorb the makyinmars work first — happy to help with that as a follow-up.
• Tooling: the update-alleycat-main.sh pin-survival fix this PR carried landed differently (and more generally) in fix(thread): keep metadata thread reads paginated #307: any rev-pinned git dep is now treated as pinned, so CI's shared-prep no longer overrides fork pins.
• Version bump: kittylitter 0.3.7 reached main through fix(thread): keep metadata thread reads paginated #307's coordinated bump and was already tagged/released as v0.3.7 from main today.
• Docs: the audit/README updates pointing at a 0xSero production pin no longer describe main; they should follow the actual pin lineage instead — tracked via the audit doc refresh.

The claude review of this PR earlier today found the pins themselves internally consistent; it's the ground truth that moved. Nothing here is lost — every intent is either merged or captured above.