Refresh routine Rust patch dependencies

[dependabot]

Summary

Refresh the current Rust lockfile with the routine patch set:

• clap 4.6.1 → 4.6.5
• serde_json 1.0.150 → 1.0.151
• thiserror 2.0.18 → 2.0.19
• direct getrandom 0.4.2 → 0.4.3

The branch was rebuilt from current main so it preserves the merged rand 0.9.5 security fix. The stale Dependabot head was not merged because its old lockfile would have regressed rand to vulnerable 0.9.2.

Diff scope

• Only core/rust/Cargo.lock
• 40 insertions, 199 deletions
• No manifest, source, protocol, workflow, migration, or public API changes
• The transitive WASI/WIT removals are the expected result of getrandom 0.4.3 replacing those dependencies with manual bindings

Branch and commit integrity

• Base: main
• Validated base SHA: ce8a0b20818ff6f19921ce9fe546d36dae4d1a23
• Ahead/behind: 1/0
• One logical commit: 556b5db — Refresh routine Rust patch dependencies
• Final diff contains only the intended lockfile

Ledger: not applicable — dependency-only lockfile maintenance is not ledger-significant.

Version: not applicable — no package manifest or public API version changed; the repository dependency policy batches Cargo patch updates in lockfile PRs.

Validation

Mode 3 — shared dependency/runtime change.

Local proof on 556b5db:

• git diff --check origin/main...HEAD: PASS
• rustup run 1.86.0 cargo metadata --locked --no-deps --manifest-path core/rust/Cargo.toml: PASS
• rustup run 1.86.0 cargo test --locked --manifest-path core/rust/Cargo.toml: PASS
• locked dependency trees confirm rand 0.9.5 and direct getrandom 0.4.3: PASS
• worktree clean after commit: PASS

Not run locally: TS, target-WASM, and macOS SDK suites — mandatory remote CI provides final-SHA proof.

Required remote CI on exact SHA 556b5dbc9161515bc0e477880a206717eef7407b: PASS — automatic Linux checks, macOS sdk-platform, evidence bundle, and fail-closed CI gate.

CI context names unchanged.

Runtime and documentation safety

• No source path changed
• No invariant removed or weakened
• No invariant regression introduced
• No DB migration changed
• No docs/runbook update required; existing dependency policy already governs this grouped patch lane

Rollback

Rollback: revert this PR.

DB downgrade: not applicable.

Data repair: not applicable.

Operational caveats: none known.

Known residual risks

None known. Mandatory remote CI and review-thread checks are clean on the exact final SHA.