Prepare v0.2.8 dependency roll

[yvette-carlisle]

Summary

• bump the Rsnap workspace and internal path dependency versions to 0.2.8 for the next release PR
• refresh Cargo and SwiftPM dependency locks, including serde_json to 1.0.150 and Sparkle to 2.9.2
• roll taiki-e/install-action to v2.79.4 while preserving the repo full-SHA GitHub Actions pinning style

Dependency notes

• Cargo lock refresh updated the latest Rust 1.95-compatible graph; target-lexicon remains at 0.13.3 because cfg-expr v0.20.7 requires exactly that version through the xcap/PipeWire dependency path.
• Open Dependabot signals covered by this PR: Bump serde_json from 1.0.149 to 1.0.150 #242 (serde_json 1.0.150) and Bump taiki-e/install-action from 2.77.2 to 2.79.3 #241 (taiki-e/install-action, superseded to latest v2.79.4).
• No release tag is created here; the checked-in release runbook still owns tag publishing after PR merge and RC validation.

Verification

• cargo make fmt-toml-check
• actionlint
• external workflow ref full-SHA pin check
• cargo make check-rust
• cargo make check-swift
• cargo make test-rust (682 passed)
• cargo make test-macos-native-host
• cargo make fmt-rust-check
• cargo make fmt-swift-check
• cargo make check-vstyle-rust
• cargo make check-vstyle-swift
• cargo make test-macos-native-host-stage
• git diff --check
• staged app CFBundleShortVersionString and CFBundleVersion both read back as 0.2.8