Shkarko Token Use 1.2.5

tokenuse 1.2.5, named Fresh Start, updates the Rust and desktop dependencies, removes known vulnerable dependency versions, and adds security audits as release gates. It also fixes the WinGet release workflow's fork synchronisation.
Dependency updates
- Updated Tauri to 2.11.5 and refreshed its build tooling and plugins, including the fixes for the Windows/Android origin-confusion advisory in versions through 2.11.0.
- Updated the PDF renderer to Fulgur 0.40 and its PDF dependencies, addressing the advisories found in the previous locked versions. HTML/PDF exports now use its current rendering API.
- Applied the report's print stylesheet directly during PDF rendering and placed page breaks between sections, preventing a blank fourth page. The export test now checks the PDF's page count.
- Updated the remaining Rust dependencies and regenerated both lockfiles, including SQLite, Excel exports, terminal rendering, HTTP downloads, and OS credential storage.
- Migrated HTTP requests to ureq 3 while retaining the quota-sync authentication headers, optional endpoint handling, and 20-second request timeout.
- Updated Svelte, Vite, the Tauri frontend packages, fonts, icons, and supporting libraries. Replaced the deprecated lucide-svelte package with @lucide/svelte. TypeScript stays on the latest 6.x release supported by the current Svelte checker.
Release safeguards
- CI now audits both Rust lockfiles against RustSec and audits the desktop lockfile with pnpm, including development dependencies. Failed audits block release builds.
- AGENTS.md requires the full root and desktop checks and all three security audits before each release, followed by verification of the published assets and distribution jobs.
- Tagged releases publish their checked-in title and release notes automatically and require a matching release notes file.
- Fixed WinGet fork synchronisation by using gh repo sync and checking that the configured classic PAT has both public_repo and workflow scopes.
Upgrade notes
- No new archive migration or configuration format change is introduced by this release.
- The updated lockfiles have no known vulnerabilities reported by cargo-audit and no advisories reported by pnpm audit at release preparation. RustSec still reports upstream maintenance warnings and the Linux GTK dependency's glib unsoundness warning; these remain visible in CI for review.
- Windows executables and installers remain unsigned with Authenticode. Tauri updater signatures protect updater downloads but do not establish Windows publisher reputation. Dependency updates alone do not establish the cause of the reported antivirus detection or guarantee it is resolved.