fix(deps): patch Rust XML advisory paths

[saagpatel]

What

• Upgrade the calamine/plist runtime chain so production quick-xml resolves to 0.41.
• Keep the legacy wayland-scanner quick-xml path explicitly build-only and time-bounded.
• Tighten dependency-watch terminal output and advisory regression coverage.

Why

• The prior dependency-watch repair merged, but the Rust advisory follow-up remained validated and uncommitted in the interrupted lane.
• Runtime XML parsing should not retain the affected dependency path, and the remaining build-only exception must stay visible to automation.

How

• Upgrade calamine from 0.26 to 0.36 and plist from 1.8 to 1.10, refreshing Cargo.lock.
• Make the cargo-audit wrapper preserve structured status and warning semantics.
• Add completion-contract and Rust dependency graph regression tests.
• Refresh ADR and security baseline documentation with the residual waiver boundary.

Testing

• Commands run: canonical .codex verify runner; focused Python contract/security tests; cargo audit JSON wrapper; locked XLSX Rust test; workflow YAML parse; shell syntax check; diff check.
• Results: 70 UI test files / 279 tests passed; 312 Rust unit tests plus integration/doc suites passed; 11 focused Python tests passed; cargo audit found 0 vulnerabilities; visual, accessibility, responsive, secret, workflow, and bundle gates passed. The first build-time sample was noisy at +22.6%; exact rerun was +13.9%, inside the 15% threshold.

Performance impact

• Bundle delta: +3.74%, inside the 10% threshold.
• Build time delta: +13.89% on confirmation rerun, inside the 15% threshold.
• Lighthouse delta: not applicable; no UI behavior changed.
• API latency delta: not applicable.
• DB query delta: not applicable.

Risk / Notes

• Low runtime risk; the change is dependency and automation-contract scoped.
• Cargo audit still reports informational yanked-package warnings for core2/js-sys/wasm-bindgen; no vulnerability is reported.
• The remaining older quick-xml instance is build-only through wayland-scanner and remains governed by the documented waiver.

Screenshots (UI only)

• Not applicable; no UI changes.

Lockfile rationale (if lockfile changed)

• Cargo.lock is intentionally refreshed for calamine 0.36, plist 1.10, and quick-xml 0.41 runtime resolution. The build-only wayland-scanner chain is retained and explicitly documented.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 889c649f01

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Guard quick-xml waivers by dependency path

Switching the scheduled Rust audit to the waiver wrapper means the JSON summary is produced after the wrapper's global --ignore RUSTSEC-2026-0194/0195; cargo-audit documents --ignore as ignoring advisory IDs, not dependency paths (docs). I checked this workflow and it does not run the new tests/security/test_rust_dependency_advisories.py path guard, so if a later lockfile update reintroduces quick-xml <0.41 through calamine/plist or another runtime parser, dependency-watch can suppress the alert even though the waiver is intended only for wayland-scanner. Run the path guard here or make the wrapper fail when the ignored quick-xml advisories appear outside the trusted build-time chain.

Useful? React with 👍 / 👎.