build(deps): bump the cargo-dependencies group in /desktop with 5 updates

desktop/Cargo.toml

@@ -32,7 +32,7 @@ socket2 = "0.6.5"
 httparse = "1.10.1"
 network-interface = "2.0.5"
 calamine = "0.37.0"
-rust_xlsxwriter = "0.100.0"
+rust_xlsxwriter = "0.101.0"
 zip = { version = "9.0.5", default-features = false, features = ["deflate"] }
 
 [target.'cfg(windows)'.dependencies]

docs/FILE-COMPARISON.md

@@ -6301,7 +6301,7 @@ Verdict: **scoped-improvement**. Revision: `filesystem-snapshot`. Original-byte
 
 Verdict: **equivalent-behavior**. Revision: `filesystem-snapshot`. Original-byte SHA-256: `5e6becf3291f81ae0307f6b78c57659cfab5abc13d9afc7bf0a3ff3f6248d608`.
 
-- Target: `desktop/Cargo.lock:5318 [UTF8-LF sha256=5db30a66eec5474a07fe5c9cfabb39cbbc35e6d4c6ac12450c26202849b61e0e; anchor=name = "tungstenite"]`.
+- Target: `desktop/Cargo.lock:5318 [UTF8-LF sha256=41cd879cba4d3f9922b7879a32ea0b52422317ed8d144c598061416d7c554410; anchor=name = "tungstenite"]`.
 - Retained: Read all 836 lockfile lines through EOF, including both npm v2 package and duplicated dependency trees. Reproducible transport dependency pinning is retained by the current native lockfile.
 - Omitted/replaced code: `obsolete npm v2 Socket.IO/chokidar dependency graph`. Disposition: **replaced**. Reason: No production Node update daemon remains. Retaining its 2023 graph would add an unused install/cache and duplicated attack surface without preserving functionality.
 - Omitted/replaced code: `Darwin-only fsevents and duplicated ws 8.11/8.14 records`. Disposition: **not-applicable**. Reason: The Windows/embedded deployment does not use this file watcher stack; Rust/firmware lock their own actually linked transports.
@@ -6311,7 +6311,7 @@ Verdict: **equivalent-behavior**. Revision: `filesystem-snapshot`. Original-byte
 
 Verdict: **equivalent-behavior**. Revision: `filesystem-snapshot`. Original-byte SHA-256: `03d35d925349974134ff5a047503ac6772459893c6ef89219b825ef60cd0d5ed`.
 
-- Target: `desktop/Cargo.toml:23 [UTF8-LF sha256=e330c25d8ba662bc8ffb5b848f669cc7af8882b13deff29e91606b43c90ff233; anchor=tungstenite =]`.
+- Target: `desktop/Cargo.toml:23 [UTF8-LF sha256=a2e630c36ed867fff731d7dea275109570f05bd22c0c26c775a17b6a81df9df8; anchor=tungstenite =]`.
 - Retained: Read the complete dependency manifest. WebSocket client/server, HTTP/TLS, hashing and structured serialization needs are owned by the native Rust client and firmware platform rather than a second Node update daemon.
 - Omitted/replaced code: `chalk, chokidar, Socket.IO and ws runtime stack`. Disposition: **replaced**. Reason: The production native app already uses pinned rustls HTTP/WebSocket crates and the board uses its bounded embedded services. A parallel Node daemon would duplicate connection/update authority.
 - Omitted/replaced code: `http 0.0.1-security placeholder and missing tmp dependency used by Client.js`. Disposition: **replaced**. Reason: The placeholder adds no HTTP implementation and the manifest cannot reproduce its own client. Current builds use declared, locked dependencies or Node standard modules only.

docs/REUSE-PREFLIGHT-RECEIPT.md

@@ -12100,6 +12100,24 @@ bluetooth/source wiring was inspected; this is fixture repair, not BLE radio
 acceptance. Combined shell and audit fixtures pass; final SSH/quality/SDK/client
 CI remains a separate exact-head gate. No boards or production apps changed.
 
+## GitHub handoff dependency repair (2026-11-05)
+
+PR45's mixed egui0.36/0.37 graph is a real incompatibility, not a flaky test.
+Read the proposed manifest/lock changes, the graph guard and Pealayer's actual
+Cargo manifest at9dfc54d3 (including its separately pinned Dock0.37 port).
+Keep the verified0.36 framework/theme/Dock family for this integration; retain
+the independent uuid1.29, rust_xlsxwriter0.101 and zip9.1.2 lock updates.
+The original bot proposal remains in Git history. The complete paired framework
+migration, including CraftUI and pointer geometry/captures, is tracked in issue50;
+it is not declared implemented merely to empty the PR list.
+
+Reread the consumer manifest, full resulting lock diff and unchanged PuzzleBoard
+package metadata; rebind only their inspected consumer hashes. The coherent-family
+test passes with both mixed-family negative cases intact. Live donor consultation
+reported Pealayer inventory drift, which is being reviewed separately on the UI
+integration branch; no guard, source verdict or physical acceptance is waived.
+Exact-head Windows compilation/package and full CI remain required before merge.
+
 ## Windows WebSocket-bootstrap fixture repair (2026-10-30, PR43)
 
 Actions run41080991373 failed in the loopback server at peer_http.rs:746:

docs/file-comparison-evidence.json

@@ -10298,7 +10298,7 @@
       "targets": [
         {
           "path": "desktop/Cargo.toml",
-          "sha256": "e330c25d8ba662bc8ffb5b848f669cc7af8882b13deff29e91606b43c90ff233",
+          "sha256": "a2e630c36ed867fff731d7dea275109570f05bd22c0c26c775a17b6a81df9df8",
           "anchor": "tungstenite ="
         }
       ],
@@ -10333,7 +10333,7 @@
       "targets": [
         {
           "path": "desktop/Cargo.lock",
-          "sha256": "5db30a66eec5474a07fe5c9cfabb39cbbc35e6d4c6ac12450c26202849b61e0e",
+          "sha256": "41cd879cba4d3f9922b7879a32ea0b52422317ed8d144c598061416d7c554410",
           "anchor": "name = \"tungstenite\""
         }
       ],