fix(OPENFRAM-010-9): CU-86akdyq31 windows-core version pinned as loose "0.61" without lockstep guard against windows crate bump

[flamingo]

Closes findings from rule OPENFRAM-010-9 — windows-core version pinned as loose "0.61" without lockstep guard against windows crate bump.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🔴 55 low — review closely	windows-core version pinned as loose "0.61" without lockstep guard against windows crate bump	src-tauri/Cargo.toml:67

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: a07442c8-7c54-4c4f-ac5d-d96e3425fe4c

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akdyq31 OpenFrame desktop windows activator fixes (6 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 windows-core version pinned as loose "0.61" without lockstep guard against windows crate bump

In src-tauri/Cargo.toml, under [target.'cfg(target_os = "windows")'.dependencies], changed windows = { version = "0.61", ... } to windows = { version = "=0.61.0", ... } and windows-core = "0.61" to windows-core = "=0.61.0", plus extended the existing comment to explain the pinning rationale. Exact-version pins mean cargo update/a future edit cannot silently drift either crate to a new minor/patch independently, forcing an explicit, simultaneous edit of both lines to bump — turning the previously-undocumented-in-tooling lockstep requirement into a build-time-enforced one. Residual risk: this does not prevent a human from editing only one line and still merging that change, since Cargo itself won't detect a "0.62" typed into just one field as wrong; it only prevents transitive resolver drift. A more complete guard (e.g. a workspace-level xtask/CI check comparing the two strings) would require new tooling outside this file's scope.

🤖 Prompt for AI agents

In src-tauri/Cargo.toml around line 67, review and complete this code-review fix: windows-core version pinned as loose "0.61" without lockstep guard against windows crate bump.
What the draft fix changed: In `src-tauri/Cargo.toml`, under `[target.'cfg(target_os = "windows")'.dependencies]`, changed `windows = { version = "0.61", ... }` to `windows = { version = "=0.61.0", ... }` and `windows-core = "0.61"` to `windows-core = "=0.61.0"`, plus extended the existing comment to explain the pinning rationale. Exact-version pins mean `cargo update`/a future edit cannot silently drift either crate to a new minor/patch independently, forcing an explicit, simultaneous edit of both lines to bump — turning the previously-undocumented-in-tooling lockstep requirement into a build-time-enforced one. Residual risk: this does not prevent a human from editing only one line and still merging that change, since Cargo itself won't detect a "0.62" typed into just one field as wrong; it only prevents *transitive* resolver drift. A more complete guard (e.g. a workspace-level xtask/CI check comparing the two strings) would require new tooling outside this file's scope.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer