Upgrade ratatui 0.29→0.30 and Tauri GTK3→gtk4 (clears suppressed advisories RUSTSEC-2026-0002 / RUSTSEC-2024-0429)

[ravituringworks]

Tracks the two transitive dependency upgrades that would let us remove the corresponding deny.toml suppressions (added/confirmed 2026-06-13, review-by 2026-08-19) and that back Dependabot alerts #14 and #15.

1. ratatui 0.29 → 0.30 — clears lru RUSTSEC-2026-0002 (Dependabot #15)

• Vuln: lru 0.12.5 IterMut Stacked-Borrows unsoundness (low; not attacker-reachable — internal TUI layout cache).
• Why blocked: ratatui 0.29 pins lru = "^0.12", so cargo update -p lru --precise 0.16.3 does not resolve. Fix requires lru ≥ 0.16.3, which only newer ratatui carries.
• Work: bump workspace ratatui = "0.29" → 0.30. 0.30 split into modular crates (ratatui-core, ratatui-widgets, …) with breaking API changes — needs a pass over vibecli-cli/src/tui/** + test.

2. Tauri GTK3 → gtk4 / webkit2gtk-6.0 — clears glib RUSTSEC-2024-0429 + the gtk-rs 0.18 family RUSTSEC-2024-0411..0420 (Dependabot #14)

• Vuln: glib 0.18.5 unsound VariantStrIter (medium; Linux-only, never called by us — macOS build has no glib).
• Why blocked: the whole GTK3 stack (glib/gtk 0.18 ← libappindicator/muda/tao ← tauri 2.11.2) is pinned by Tauri. Upstream Tauri must migrate to gtk4 + webkit2gtk-6.0 first.
• Work: upstream-gated — bump Tauri once a gtk4 release lands; then drop the eleven RUSTSEC-2024-04xx + the 0429 suppressions from deny.toml.

Not in scope

torch CVE-2025-3000 (Dependabot #16) has no upstream fix and is already suppressed in the pip-audit torch block (security.yml, review-by 2026-08-19). It is not a cargo/deny.toml item.

---

Suppressions live in deny.toml ([advisories.ignore]) with a 2026-08-19 quarterly review; this issue is the "fix the root cause" counterpart.