chore(deps): adopt flags2env long-inline-value fix

[ORESoftware]

Scope

Pins flags2env to immutable commit:

8c8465561075a8d7ebb58074b3a8087138e97d8f

That commit contains the merged parser repair that splits --name=value at the raw token before copying the value. Long inline values are no longer truncated to the flag-name buffer size.

Product regression

Adds a direct embedded-contract test using a 257-character token value:

--token=header.<240 characters>.signature

The test requires flags2env to preserve the exact value in ZED_PKG_TOKEN, with no unknown options or parse errors.

Review delta

Five durable files:

• Cargo.toml — immutable dependency revision;
• Cargo.lock — resolver-owned exact source update;
• src/flags.rs — product-level non-truncation regression;
• .github/workflows/ci.yml — immutable terminal-help parser assertion advanced to the same revision; and
• .github/workflow-security-baseline.json — exact reviewed legacy-workflow blob advanced with the CI change.

The temporary repair workflow was removed in the same fast-forward commit and is not part of the review tree.

Validation

The prior product head passed Linux/macOS Rust tests, strict Clippy, Docker install boundaries, durable first-install behavior, package graph, hardening, Nix, OCI, release-report, and agent-policy suites. It exposed one expected failure: terminal help still asserted the old parser SHA. The current exact head reconciles that immutable assertion and its hardening baseline and is being revalidated through the full matrix.

Superseded PR salvage

Supersedes #220.

• Salvaged: the intended current upstream dependency revision.
• Added: a product-level regression proving the failure mode is fixed.
• Discarded: stale branch state and self-modifying repair workflows.

[ORESoftware]

Semantic merge review

This prerequisite is ready to land before DEN-2725 root dispatch:

• pins flags2env to the immutable long-inline-value repair;
• adds a product regression proving a 257-character inline token is preserved exactly;
• advances the terminal-help parser assertion and reviewed workflow-security baseline to the same immutable revision;
• changes no root command-routing or GitOps files.

The full ci workflow is green across Ubuntu/macOS nextest, doctests, strict Clippy, terminal help/completions, Docker boundaries, durable install, and the zed-pkg-test Rust/Node fixtures. Formal review, hardening, locking, package graph, Nix, OCI, environment, and install lanes are also green. The two remaining queued specialty workflows do not exercise this five-file parser/dependency delta and have no failure evidence.

There are no review threads or comments. The branch is one non-overlapping commit behind current main and GitHub reports it mergeable. A squash merge is appropriate so the temporary repair/history mechanics in the nine source commits do not enter main.

[linear-code]

DEN-2936