chore: switch cargo deps-age gate to native when -Zmin-publish-age stabilizes

[EVWorth]

Goal

Drop the Dependabot-side cooldown: { default-days: 7 } workaround for cargo and switch to native crate-version-age enforcement (-Zmin-publish-age / RFC 3923) once it lands on Rust stable.

Background

For supply-chain defense, every dep update must be ≥7 days old before being pulled into this project. As of 2026-07-19:

• npm — handled natively by .npmrc min-release-age=7 (npm help install).
• Dependabot-driven cargo bumps — handled by cooldown: { default-days: 7 } in .github/dependabot.yml (PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224).
• \u0060cargo update\u0060 / \u0060cargo install\u0060 on dev machines — only available path today is the post-hoc cargo audit-style wrapper, OR opt-in nightly Cargo with -Zmin-publish-age.

Native option: RFC 3923 / -Zmin-publish-age

• RFC: https://github.com/rust-lang/rfcs/blob/master/text/3923-cargo-min-publish-age.md — merged 2026-05-18
• Tracking: Tracking Issue for min-publish-age RFC 3923 rust-lang/cargo#17009
• Implementation: rust-lang/cargo#17012 — merged 2026-06-18, milestone 1.98.0
• Stable availability (projected): roughly Aug–Sep 2026 if Cargo's usual nightly→stable window holds (~6–12 weeks)

When this lands on stable Rust, the migration is:`

# `src-tauri/.cargo/config.toml`
[registry]
global-min-publish-age = "7 days"

# optional: per-registry override
# [registries.crates-io]
# min-publish-age = "7 days"

# override for urgent security bumps:
# CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update clap --precise 4.5.3

Once native enforcement is on, Dependabot's cargo cooldown can be relaxed or removed (it's belt-and-suspenders against bot-driven bumps; native covers manual cargo update).

Acceptance criteria

• rust-lang/cargo#17009 releases on stable Rust (~\u003e= 1.98)
• Add registry.global-min-publish-age = "7 days"\u0060 to src-tauri/.cargo/config.toml(or repo-root.cargo/config.toml` if preferred)
• Verify cargo build / cargo test against a deliberate pin override (CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update … --precise X) still works for urgent security bumps
• Decide whether to keep or remove the cargo `cooldown\u0060 in dependabot.yml (recommendation: keep as defense-in-depth, then remove if it creates dup-alert noise)

Related

• PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224 (Dependabot cooldown + .npmrc + script deletion) — the prior change
• fix: 5 cargo deps too new for npm deps:check gate #223 — the original "rule works correctly" finding that kicked off this workstream
• Cargo nightly doc: https://doc.rust-lang.org/cargo/reference/unstable.html#min-publish-age
• Cargo config doc: https://doc.rust-lang.org/cargo/reference/config.html