chore(deps): bump rustls-webpki and rand for Dependabot alerts

[hakula139]

Summary

Address 3 low-severity Dependabot alerts via Cargo.lock-only updates, plus evidence on why the rand alert is effectively a false positive.

Package	From → To	Resolution
rustls-webpki	0.103.11 → 0.103.12	Patched. Closes both GHSA-965h-392x-2mh5 (URI name constraints) and GHSA-xgp8-3hg3-c2mh (wildcard name constraints). Actually in our compiled binary via reqwest → rustls.
rand	0.8.5 → 0.8.6	Latest 0.8.x reachable through transitive deps. The advisory GHSA-cq8v-f236-94qc lists 0.9.3+ as patched, but see the note below — this code isn't actually compiled for our feature set.

Why not just bump rand to 0.9.x?

rand is not a direct dependency. It enters Cargo.lock only through this chain:

ratatui 0.30 → ratatui-termwiz → termwiz → terminfo → phf_codegen → phf_generator 0.11.3 → rand

• phf_generator 0.11.3 is pinned to rand 0.8.x — rand 0.9.x has breaking API changes and requires an upstream phf_generator release to consume.
• Forcing 0.9.x via [patch.crates-io] would almost certainly fail to compile phf_generator — no actual security benefit.
• More importantly: cargo tree (default features, default target) shows no rand in the active build graph — only fastrand, a different crate. The termwiz backend that drags in rand is not enabled; we use crossterm. rand is in Cargo.lock because Cargo pre-resolves every possible feature / target combo, but the vulnerable code path is never compiled into our binary.

The 0.8.6 bump is applied as best-effort hygiene. If GitHub's Dependabot still considers the alert open after merge (because 0.8.6 is in the < 0.9.3 advisory range), dismiss as "Not affected" — it's accurate.

Why the rustls-webpki bump matters

rustls-webpkiis compiled into our binary via reqwest → rustls. The name-constraint flaws affect TLS clients verifying untrusted server certs — we only connect to Anthropic's public-CA-signed API, so the flaws aren't exploitable for us, but the bump is free and cleanly closes both alerts.

Test plan

• cargo build — compiles
• cargo test — 600 pass (no test changes)
• cargo tree — confirms no rand in the active build graph (only fastrand, which is unrelated)
• No source-code changes; lockfile-only