[mostafa]

Summary

• Rolls up the four compatible Dependabot PRs that opened after chore(deps): batch dependency updates (Oct 2026) #544 merged. Cargo.lock is regenerated against current main.
• Rust: updates async-nats from 0.49.1 to 0.50.0 (build(deps): bump async-nats from 0.49.1 to 0.50.0 #549) and opentelemetry-proto from 0.32.0 to 0.33.0 (build(deps): bump opentelemetry-proto from 0.32.0 to 0.33.0 #548), including their aligned opentelemetry and opentelemetry_sdk dependencies.
• CI: repins taiki-e/install-action from v2.87.20 to v2.87.21 by full commit SHA (build(deps): bump taiki-e/install-action from 2.87.20 to 2.87.21 in the actions-updates group #547).
• VS Code: updates @types/node from 26.6.2 to 26.6.3 (build(deps-dev): bump @types/node from 26.6.2 to 26.6.3 in /editors/vscode in the npm-updates group #546).
• The existing holds remain unchanged: yamlpath/yamlpatch 1.30.1 require Rust 1.97, and tikv-jemallocator 0.7.0 has the measured musl throughput regression.

Closes #546, closes #547, closes #548, closes #549.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo doc --workspace --all-features --locked --no-deps
• cargo test -p rsigma-runtime --all-features --locked
• cargo test -p rsigma --all-features --locked
• cargo audit and cargo deny check
• zizmor --pedantic .github/workflows
• VS Code extension: npm ci, npm run compile, and tsc --noEmit
• CI green on all platforms