chore(deps): in-range cargo update, refresh cargo-vet exemptions

[send]

Summary

• cd engine && cargo update — in-range only, no majors bumped.
• Regenerated supply-chain/config.toml exemptions (cargo vet regenerate exemptions) so cargo vet check passes against the new versions; supply-chain/imports.lock was refreshed from upstream (google/isrg/mozilla/zcash) at the same time.

Bumped (33 crates, all transitive, all in-range)

crate	old → new
aho-corasick	1.1.4 → 1.1.5
base64	0.22.1 → 0.23.1
bytemuck_derive	1.11.0 → 1.12.0
camino	1.2.2 → 1.2.5
cc	1.4.0 → 1.4.4
clap	4.6.1 → 4.6.6
clap_builder	4.6.0 → 4.6.6
clap_derive	4.6.1 → 4.6.4
crc32fast	1.5.0 → 1.5.1
either	1.17.0 → 1.18.0
find-msvc-tools	0.1.9 → 0.1.11
futures-core/task/util	0.3.33 → 0.3.34
http	1.4.2 → 1.5.0
js-sys	0.3.103 → 0.3.104
log	0.4.33 → 0.4.34
macro_rules_attribute(+proc_macro)	0.2.2 → 0.2.3
pastey	new transitive dep of macro_rules_attribute 0.2.3
pkg-config	0.3.33 → 0.3.34
regex-automata	0.4.16 → 0.4.18
rustls	0.23.41 → 0.23.43
rustls-webpki	0.103.13 → 0.103.15
syn	3.0.3 → 3.0.4
thiserror(+impl)	2.0.19 → 2.0.20
time	0.3.54 → 0.3.55
ureq(-proto)	3.3.0 → 3.4.0 / 0.6.0 → 0.6.1
wasm-bindgen family / web-sys	0.2.126 → 0.2.127 / 0.3.103 → 0.3.104
zerocopy(-derive)	0.8.55 → 0.8.56
zlib-rs	0.6.6 → 0.6.7

Reverted for the 7-day quarantine (scripts/check-quarantine.sh)

cargo update -p <crate> --precise <old> back to the pre-update version — none carry an advisory that would require adopting the newer version immediately, so a plain revert (rather than quarantine-allowlist.toml) was sufficient:

• flate2 1.1.10 → reverted to 1.1.9 (published 3 days ago; also reverts transitive miniz_oxide 0.9.1 → 0.8.9)
• hermit-abi 0.5.3 → reverted to 0.5.2 (published 0 days ago)
• indexmap 2.14.1 → reverted to 2.14.0 (published 3 days ago)

Gates

• cargo fmt --all --check — pass
• cargo clippy --workspace --all-targets --all-features -- -D warnings — pass, no warnings
• cargo test --workspace --all-features — 464 passed, 4 ignored. 2 pre-existing failures (t10_a_promotion_that_failed_schedules_its_own_retry, t10_an_unreadable_marker_is_never_recorded_as_an_observation) reproduce identically on unmodified main in this sandbox — the fixtures rely on chmod blocking reads/writes, which doesn't apply when running as root, and are unrelated to this change. They should pass under CI's non-root runner.
• scripts/check-quarantine.sh — pass (all changed deps ≥7 days old after the 3 reverts above)
• cd engine && cargo vet check — pass (54 fully audited, 2 partially audited, 230 exempted)
• cd engine && cargo deny check — advisories ok, bans ok, licenses ok, sources ok (no new advisories introduced by this bump)

Not run: mise run accuracy / mise run accuracy-history. This sandbox's GitHub access is scoped to send/lexime only, and dictool fetch needs api.github.com/repos/google/mozc to build engine/data/lexime.{dict,conn} from scratch — that call is rejected here, so the corpora can't be built locally. None of the bumped crates touch dictionary/tokenization/Viterbi code paths (they're compression, CLI-parsing, TLS, error-derive, and wasm-bindgen infra crates), so accuracy risk is low, but please let CI's accuracy job (which runs outside this sandbox) confirm before merging, or run it locally.

Test plan

• CI: fmt / clippy / cargo test
• CI: supply-chain audit (quarantine, cargo deny check, cargo vet check, cargo machete)
• CI: mise run accuracy and mise run accuracy-history both green (please confirm on this PR's checks before merging — not verified locally, see above)

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T03:23:50.530388Z	1ae5d11	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.