fix: resolve Dependabot + code scanning alerts

[aagarwal1012]

Summary

Resolves all addressable open security alerts: 5 of 7 fixed (3 Dependabot, 3 code scanning), 2 upstream-blocked (documented below).

Dependabot (3 fixed, 2 upstream-blocked)

Alert	Package	Before	After	Severity	GHSA
#2	time	0.3.45	0.3.47	medium	GHSA-r6v5-fh4h-64xc
#3	rand (0.9.x)	0.9.2	0.9.3	low	GHSA-cq8v-f236-94qc
#4	rand (0.8.x)	0.8.5	0.8.6	low	GHSA-cq8v-f236-94qc

Upstream-blocked (will be dismissed with reason)

Alert	Package	Why it can't be fixed
#1	glib 0.18.5	Hard-pinned by gtk 0.18 which is hard-pinned by tauri 2.10.3. gtk-rs 0.18 branch is EOL/unmaintained. Tauri maintainers have marked this wontfix (tauri#12048). Fix requires Tauri's in-progress GTK4 migration (tauri#14684). Linux-only; macOS/Windows builds unaffected.
—	rand 0.7.3	Build-dep only (pulled by tauri-build → kuchikiki → selectors → phf_codegen 0.8). No fix exists in the 0.7.x branch — it's abandoned. Does not ship in the compiled binary.

Code scanning (3 fixed)

Resolved all 3 actions/unpinned-tag warnings in .github/workflows/build.yml by pinning actions to full commit SHAs:

Alert	Action	Before	After
#1	dtolnay/rust-toolchain	@stable	@29eef336d9b2848a0b548edc03f92a220660cdb8 (stable, 2026-03-27)
#2	swatinem/rust-cache	@v2	@c19371144df3bb44fab255c43d04cbc2ab54d1c4 (v2.9.1)
#3	tauri-apps/tauri-action	@v0	@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 (action-v0.6.2)

Version comments follow GitHub's documented security pattern — Dependabot parses them to propose future version bumps.

Verification

• cargo check --all-targets passes clean on macOS
• LSP diagnostics clean on build.yml
• No transitive version regressions introduced (only the alerted packages and their required compatibility updates: mac-notification-sys 0.6.10 → 0.6.12, notify-rust 4.12.0 → 4.16.0)
• Full cross-platform CI build — will run automatically on this PR

How to test locally

cd src-tauri
cargo check --all-targets
cargo tree -i time:0.3.47    # confirm no 0.3.45 remains
cargo tree -i rand:0.8.6     # confirm no 0.8.5 remains
cargo tree -i rand:0.9.3     # confirm no 0.9.2 remains

Notes for reviewer

• The 3 workflow action pins carry trailing # version comments — these are required per GitHub security docs and enable Dependabot's automated version bumps. Please do not strip them.
• Two alerts are being dismissed after this PR merges (glib, rand 0.7.3) — both are upstream-blocked with no action available to this repo.