chore: switch cargo deps-age gate to native when -Zmin-publish-age stabilizes

[EVWorth]

Goal

Drop the Dependabot-side cooldown: { default-days: 7 } workaround for cargo and switch to native crate-version-age enforcement (-Zmin-publish-age / RFC 3923) once it lands on Rust stable.

Background

For supply-chain defense, every dep update must be ≥7 days old before being pulled into this project. As of 2026-07-19:

• npm — handled natively by .npmrc min-release-age=7 (npm help install).
• Dependabot-driven cargo bumps — handled by cooldown: { default-days: 7 } in .github/dependabot.yml (PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224).
• \u0060cargo update\u0060 / \u0060cargo install\u0060 on dev machines — only available path today is the post-hoc cargo audit-style wrapper, OR opt-in nightly Cargo with -Zmin-publish-age.

Native option: RFC 3923 / -Zmin-publish-age

• RFC: https://github.com/rust-lang/rfcs/blob/master/text/3923-cargo-min-publish-age.md — merged 2026-05-18
• Tracking: Tracking Issue for min-publish-age RFC 3923 rust-lang/cargo#17009
• Implementation: rust-lang/cargo#17012 — merged 2026-06-18, milestone 1.98.0
• Stable availability (projected): roughly Aug–Sep 2026 if Cargo's usual nightly→stable window holds (~6–12 weeks)

When this lands on stable Rust, the migration is:`

# `src-tauri/.cargo/config.toml`
[registry]
global-min-publish-age = "7 days"

# optional: per-registry override
# [registries.crates-io]
# min-publish-age = "7 days"

# override for urgent security bumps:
# CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update clap --precise 4.5.3

Once native enforcement is on, Dependabot's cargo cooldown can be relaxed or removed (it's belt-and-suspenders against bot-driven bumps; native covers manual cargo update).

Acceptance criteria

• rust-lang/cargo#17009 releases on stable Rust (~\u003e= 1.98)
• Add registry.global-min-publish-age = "7 days"\u0060 to src-tauri/.cargo/config.toml(or repo-root.cargo/config.toml` if preferred)
• Verify cargo build / cargo test against a deliberate pin override (CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow cargo update … --precise X) still works for urgent security bumps
• Decide whether to keep or remove the cargo `cooldown\u0060 in dependabot.yml (recommendation: keep as defense-in-depth, then remove if it creates dup-alert noise)

Related

• PR fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper) #224 (Dependabot cooldown + .npmrc + script deletion) — the prior change
• fix: 5 cargo deps too new for npm deps:check gate #223 — the original "rule works correctly" finding that kicked off this workstream
• Cargo nightly doc: https://doc.rust-lang.org/cargo/reference/unstable.html#min-publish-age
• Cargo config doc: https://doc.rust-lang.org/cargo/reference/config.html

[EVWorth]

Status check, since this is the only issue left that is genuinely blocked upstream.

cargo -Z min-publish-age is still nightly-only as of Rust 1.94 — RFC 3923 has not landed on stable, so the workaround this issue exists to remove is still the only option for cargo.

Nothing to do here yet. The two things that would change that:

1. min-publish-age appearing in a stable Cargo release, at which point the cooldown block in .github/dependabot.yml comes out and the setting goes in .cargo/config.toml where it covers cargo update on dev machines too — which the Dependabot workaround never did.
2. Dependabot dropping cooldown, which would force the issue sooner.

Left open deliberately: it is a real gap (a local cargo update can still pull a crate published an hour ago), tracked so it is not forgotten, and not actionable today.

[EVWorth]

Checked upstream on 2026-09-16. Stabilized in cargo, not yet on stable Rust.

Tracking issue cargo#17009	closed 2026-08-28
Stabilization PR cargo#17335	merged 2026-08-28
Lands in	Rust 1.100.0
1.100.0 branches from master	2026-09-25
1.100.0 stable	2026-11-12
Current stable	1.98.1 (2026-09-03)
Pinned in rust-toolchain.toml	1.95.0

Two corrections to the description above, both of which were reasonable when
it was written and are not any more:

• The milestone is 1.100.0, not 1.98.0. 1.98.1 has already shipped without
  the feature, so anyone checking "is it in stable yet?" against 1.98 will get
  a misleading no-for-the-wrong-reason.
• The "roughly Aug–Sep 2026" projection is off by about two months. The real
  date is 2026-11-12.

The config key stabilized exactly as the description anticipates
([registry] global-min-publish-age = "7 days", with
CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow as the escape hatch), so the
migration plan needs no revision — only the date does.

One extra step for us when it lands: this repo pins an exact toolchain, so
adopting it means bumping rust-toolchain.toml from 1.95.0 to 1.100.0 as
well. That is a deliberate change with its own blast radius, not a side effect
of the config edit.

Nothing actionable until mid-November. Worth re-checking after 2026-11-12.