[mostafa]

Summary

• Rolls up the compatible open Dependabot PRs chore(deps): bump the actions-updates group with 2 updates #525, chore(deps): bump the patch-updates group with 8 updates #526, chore(deps): bump tokio-postgres-rustls from 0.13.0 to 0.14.0 #527, and chore(deps): bump vscode-languageclient from 10.1.1 to 10.1.2 in /editors/vscode in the npm-updates group #529 into one merge. Cargo.lock is regenerated against current main instead of replaying stale bot branches.
• Rust: applies the eight-package patch group from chore(deps): bump the patch-updates group with 8 updates #526 and updates tokio-postgres-rustls from 0.13.0 to 0.14.0 from chore(deps): bump tokio-postgres-rustls from 0.13.0 to 0.14.0 #527.
• CI: repins taiki-e/install-action to v2.87.20 and github/codeql-action/upload-sarif to v4.38.2 by full commit SHA from chore(deps): bump the actions-updates group with 2 updates #525.
• VS Code: updates vscode-languageclient from 10.1.1 to 10.1.2 from chore(deps): bump vscode-languageclient from 10.1.1 to 10.1.2 in /editors/vscode in the npm-updates group #529.
• Held back: yamlpath 1.30.1 (chore(deps): bump yamlpath from 1.27.0 to 1.30.1 #495) and yamlpatch 1.30.1 (chore(deps): bump yamlpatch from 1.26.1 to 1.30.1 #494) require rustc 1.97 through tree-sitter-iter, above the 1.95.0 MSRV. tikv-jemallocator 0.7.0 (chore(deps): bump tikv-jemallocator from 0.6.1 to 0.7.0 #425) remains excluded after the measured musl daemon throughput regression.

Closes #525, closes #526, closes #527, closes #529.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo doc --workspace --all-features --locked --no-deps
• cargo test -p rsigma --all-features --locked (973 tests)
• cargo audit and cargo deny check
• zizmor --pedantic .github/workflows
• VS Code extension: npm ci, npm run compile, and tsc --noEmit
• CI green on all platforms