build: patch vulnerable dependencies

[kev1n77]

Summary

• patch diff to 8.0.3 without taking the unrelated 9.x major update
• patch time to 0.3.47 in both Rust lockfiles and serde_with to 3.21.0 in the desktop lockfile
• raise the declared Rust MSRV from 1.85 to 1.88 to match the first secure dependency releases
• document the remaining upstream Tauri/GTK3 glib advisory and its unused vulnerable API

Dependabot alerts addressed

• Add development plan and progress tracking docs #1 and feat(gateway): validate streaming passthrough #4: time stack exhaustion
• feat(prompt-ir): establish versioned prompt contract #2 and feat(proxy): add crash-safe recovery watchdog #6: diff denial of service
• feat(capture): validate mitmproxy sidecar boundary #5: serde_with serialization panic

Verification

• npm run desktop:check (46 tests)
• npm run desktop:build
• python scripts/verify_supply_chain.py
• python -m unittest discover -s scripts/tests -v
• Cargo formatting and metadata checks for both manifests

The remaining glib 0.18.5 alert is introduced by the latest Tauri Linux GTK3 stack. CodeIsCheap and the checked Tauri/Wry/GTK sources do not call the affected VariantStrIter API; it will be dismissed as not used while the upstream dependency is tracked.