chore(mesh): upgrade MeshLLM to 0.76.1

[micspiral]

Summary

Upgrade Buzz from MeshLLM v0.76.0-rc9 to the latest stable v0.76.1 release. Merged origin/main at 4cd82f513 without rewriting shared PR history.

• Update all eight Mesh git dependencies across desktop and relay smoke examples; both lockfiles resolve all 47 Mesh packages to ff18c0b5a74c0317d943bb6611a1ce4836b35d61.

• Match Mesh's ed25519-dalek = 3.0.0 and rusqlite = 0.40 dependencies.

• Explicitly enable rusqlite's fallible_uint feature, preserving Buzz's existing u64 SQL conversions when mesh is disabled. Mesh-enabled builds previously supplied this transitively, so testing both configurations matters.

• Temporarily pin only the optional sqlx-sqlite package to the merged upstream compatibility fix transact-rs/sqlx#4402, revision 94aafe3a68884d923b0798a767c8d7f6cfda89d2. SQLx 0.9.0 caps libsqlite3-sys below 0.38, while Mesh 0.76 requires 0.38. Cargo resolves the conflict even with SQLite disabled. The fix raises that upper bound; remove the patch once released. Buzz's active PostgreSQL driver stays on crates.io SQLx 0.9.0. cargo tree --locked --workspace --target all -i sqlx-sqlite reports no active consumers.

• Preserve the explicit Linux keyring 3 crypto-rust feature so Secret Service sessions retain DH encryption independently of Mesh keyring 4.

• Preserve the dedicated examples-only buzz-mesh-smoke crate and lifecycle workflow wiring, keeping Mesh/native-runtime dev dependencies out of relay CI builds.

• The v0.76.0 → v0.76.1 follow-up changes only Mesh package records in both lockfiles; all non-Mesh package records remain identical to the main-merge commit.

No application installation/launch, live inference, or lab modification was performed.

Related issue

No open stable-0.76 upgrade issue/PR found in the title search. Follows the earlier RC integration in #6189.

Originating Buzz conversation: buzz://message?channel=dffbc117-845a-4c02-bc3f-eaeeefc4deaa&id=670f9c262e1ec0a4df5600b3173a0c5de2abe17e08ba9ccfdd8eff109fadf1a8

Validation at 5bccac392d49e1e25b6c2ca5c0fc48099c45a564

Local macOS ARM64, Hermit toolchain, task-specific Cargo target:

• Passed: just ci, including formatting/static checks, workspace Clippy and both desktop feature graphs with -D warnings, Rust/desktop/mobile tests, and desktop/web builds.
• Passed: cargo test --locked -p buzz-mesh-smoke --all-targets (all six example harnesses compile; no live harness execution).
• Passed: full desktop workspace tests both default and --features mesh-llm: 3,190 and 3,296 desktop tests respectively, plus terminal/integration/doc suites.
• Passed: just desktop-tauri-clippy, locked metadata resolution, non-Mesh lock-record comparison, and git diff --check.
• Passed: normal pre-push hooks on the successful foreground push; no hooks bypassed. Earlier background push attempts were interrupted by SIGTERM.
• Not green: full cargo test --locked -p buzz-relay -- --test-threads=1: 1,034 passed / 6 failed / 97 ignored. All six failures are media-test PostgreSQL fixture setup (Sqlx(PoolTimedOut) at crates/buzz-relay/src/api/media.rs:1145). The earlier parallel run additionally failed telemetry::tests::trace_context_lookup_does_not_enable_callsites; it passed in the full serial rerun. No tests were suppressed or changed.
• Initial just ci attempts exposed three ACP default-value tests inheriting managed-agent settings, then a 2-second ACP adapter timeout. The successful complete rerun unsets only BUZZ_ACP_SESSION_POLICY, BUZZ_ACP_LAZY_POOL, and BUZZ_ACP_IDLE_POOL_SLEEP in the validation subprocess.
• Not run: live Mesh inference/admission smoke, installed-app UI exercise, or PostgreSQL/Redis integration services. CI lifecycle coverage remains necessary; unit/compile evidence is not live workflow evidence.

GitHub CI is running for the updated head; do not treat local gates as final CI approval.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 4cd82f513214aad11c2b742ce7cc7c681e8e32a0...5bccac392d49e1e25b6c2ca5c0fc48099c45a564.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5bccac392d49e1e25b6c2ca5c0fc48099c45a564 to authorize a new review.
Any previous review applies only to its recorded range.

[micspiral]

CI follow-up: not ready

Marking this PR draft until the GitHub CI failures are resolved. Local validation and PR creation were not sufficient completion evidence.

At head 5595d99dd0df0c9a36e08646b2372e32d886a3c6, CI attempt 1 has two originating failures:

1. Desktop Core: managed_agents::discovery::bounded_command::tests::returns_when_escaped_descendant_retains_pipe read an empty PID file during compiled-flag verification (3,172 passed, one failed). It passed earlier in the same run, including the mesh-enabled suite. This establishes intermittency, not that the dependency upgrade is innocent. Source is unchanged; shared libc changed from 0.2.186 to 0.2.189, required through Mesh host-runtime → mdns-sd → socket-pktinfo. The directly used Linux x86_64 FFI declarations/constants compare unchanged, but that is not runtime exoneration.
2. Relay artifact producer: GitHub annotation explicitly reports the 30-minute job limit exceeded. The exact base CI completed its build-artifacts step in 20m28s. PR attempt 1 took 8m49s for binaries and 17m59s for the backend archive, then expired while building the PostgreSQL test archive. Rust sccache misses were 25 on base versus 469 on the PR; dependency invalidation is a credible upgrade-induced CI cost. Cache modes differ (main push READ_WRITE, PR READ_ONLY), so these are observations, not a controlled cold-build benchmark. Downstream PostgreSQL and relay integration jobs did not run.

One same-head rerun is in progress. A retry passing will not alone establish that the original failures were unrelated. No tests, dependency pins, or CI limits have been changed to make this pass during follow-up.