chore(vendor): refresh vendored crate pins

Update the vendored crate set to the latest available patch/minor releases currently exposed by Flow's vendor sync loop: clap 4.6.0, rusqlite 0.39.0, toml 1.0.7+spec-1.1.0, and tracing-subscriber 0.3.23.

Why this change:
- keep the in-repo vendored set current without introducing broad source churn
- align the first-party rusqlite constraint with the newly vendored minor release so Cargo resolves the patched crate instead of silently falling back to the registry pin
- preserve the existing vendor workflow by updating only lock, manifest, and pin metadata in the main repo

Validation:
- cargo check -q
- strict vendor audit: correctness errors cleared; only pre-existing manifest metadata warnings remain
- targeted tests: read_codex_thread_schema_detects_optional_columns, derive_codex_open_plan_trace_assigns_plain_routes, build_pr_feedback_workflow_explanation_surfaces_packet_and_command, codex_eval_opportunities_flag_missing_runtime_and_daemon
- vendor iteration benchmark recorded fresh cargo check samples in out/vendor/iteration_bench.jsonl

Notes:
- full cargo test --lib still has pre-existing unrelated failures in this checkout (missing test fixtures, stale help snapshot, absolute-home-path hygiene), so this commit is validated on the dependency-sensitive surfaces rather than treated as a full green-tree sweep.

Author: nikivdev

Cargo.lock

@@ -48,7 +48,7 @@ ratatui = { version = "0.30", default-features = false, features = ["crossterm"]
 crossterm = "0.29"
 reqwest = { version = "0.13", default-features = false, features = ["json", "blocking", "query", "rustls"] }
 which = "8"
-rusqlite = { version = "0.38", features = ["bundled"] }
+rusqlite = { version = "0.39", features = ["bundled"] }
 notify = "8"
 notify-debouncer-mini = "0.7"
 shellexpand = "3"

Cargo.toml

@@ -1,14 +1,14 @@
 crate = "clap"
-version = "4.5.60"
+version = "4.6.0"
 source = "crates.io"
 registry_index = "https://github.com/rust-lang/crates.io-index"
-cargo_registry_checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
-crate_archive_sha256 = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
+cargo_registry_checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+crate_archive_sha256 = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
 checksum_match = "yes"
 upstream_repository = "https://github.com/clap-rs/clap"
 upstream_homepage = ""
-synced_at_utc = "2026-03-09T16:48:34Z"
+synced_at_utc = "2026-03-18T18:43:50Z"
 history_repo = "lib/vendor-history/clap.git"
-history_head = "dc0dce5c27d4a8f6e623fb7aad263d17d94d7d19"
+history_head = "2b9744adfa21ccac060f42fce80cfeebfbcebbe5"
 materialized_path = "lib/vendor/clap"
-sync_cmd = "scripts/vendor/inhouse-crate.sh clap 4.5.60"
+sync_cmd = "scripts/vendor/inhouse-crate.sh clap 4.6.0"

lib/vendor-manifest/clap.toml

@@ -1,14 +1,14 @@
 crate = "rusqlite"
-version = "0.38.0"
+version = "0.39.0"
 source = "crates.io"
 registry_index = "https://github.com/rust-lang/crates.io-index"
-cargo_registry_checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
-crate_archive_sha256 = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
+cargo_registry_checksum = "a0d2b0146dd9661bf67bb107c0bb2a55064d556eeb3fc314151b957f313bcd4e"
+crate_archive_sha256 = "a0d2b0146dd9661bf67bb107c0bb2a55064d556eeb3fc314151b957f313bcd4e"
 checksum_match = "yes"
 upstream_repository = "https://github.com/rusqlite/rusqlite"
 upstream_homepage = ""
-synced_at_utc = "2026-03-09T16:49:34Z"
+synced_at_utc = "2026-03-18T18:43:53Z"
 history_repo = "lib/vendor-history/rusqlite.git"
-history_head = "5aef0ef20c0bd10b243df0668db04171e42196f9"
+history_head = "ec74f8123a7ab7973c969dd538a681e5838461a4"
 materialized_path = "lib/vendor/rusqlite"
-sync_cmd = "scripts/vendor/inhouse-crate.sh rusqlite 0.38.0"
+sync_cmd = "scripts/vendor/inhouse-crate.sh rusqlite 0.39.0"

lib/vendor-manifest/rusqlite.toml

@@ -1,14 +1,14 @@
 crate = "toml"
-version = "1.0.6+spec-1.1.0"
+version = "1.0.7+spec-1.1.0"
 source = "crates.io"
 registry_index = "https://github.com/rust-lang/crates.io-index"
-cargo_registry_checksum = "399b1124a3c9e16766831c6bba21e50192572cdd98706ea114f9502509686ffc"
-crate_archive_sha256 = "399b1124a3c9e16766831c6bba21e50192572cdd98706ea114f9502509686ffc"
+cargo_registry_checksum = "dd28d57d8a6f6e458bc0b8784f8fdcc4b99a437936056fa122cb234f18656a96"
+crate_archive_sha256 = "dd28d57d8a6f6e458bc0b8784f8fdcc4b99a437936056fa122cb234f18656a96"
 checksum_match = "yes"
 upstream_repository = "https://github.com/toml-rs/toml"
 upstream_homepage = ""
-synced_at_utc = "2026-03-09T16:49:41Z"
+synced_at_utc = "2026-03-18T18:43:56Z"
 history_repo = "lib/vendor-history/toml.git"
-history_head = "86abe71bec028f0fdd6afdbe4f0f1eb2e0b41dd6"
+history_head = "9bc4b3f4804194d8a42535001fb7c9ddfde6f2b0"
 materialized_path = "lib/vendor/toml"
-sync_cmd = "scripts/vendor/inhouse-crate.sh toml 1.0.6+spec-1.1.0"
+sync_cmd = "scripts/vendor/inhouse-crate.sh toml 1.0.7+spec-1.1.0"

lib/vendor-manifest/toml.toml

@@ -1,8 +1,14 @@
 crate = "tracing-subscriber"
-version = "0.3.22"
+version = "0.3.23"
 source = "crates.io"
-synced_at_utc = "2026-02-22T18:36:56Z"
+registry_index = "https://github.com/rust-lang/crates.io-index"
+cargo_registry_checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+crate_archive_sha256 = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+checksum_match = "yes"
+upstream_repository = "https://github.com/tokio-rs/tracing"
+upstream_homepage = "https://tokio.rs"
+synced_at_utc = "2026-03-18T18:43:57Z"
 history_repo = "lib/vendor-history/tracing-subscriber.git"
-history_head = "a201388c2788499ee8681d87d5080f0b5f2e2cec"
+history_head = "86291ff1c974187a82c5d33b310940c01f1ed3a8"
 materialized_path = "lib/vendor/tracing-subscriber"
-sync_cmd = "scripts/vendor/inhouse-crate.sh tracing-subscriber 0.3.22"
+sync_cmd = "scripts/vendor/inhouse-crate.sh tracing-subscriber 0.3.23"

lib/vendor-manifest/tracing-subscriber.toml

@@ -2,7 +2,7 @@
 repo = "https://github.com/nikivdev/flow-vendor.git"
 branch = "main"
 checkout = ".vendor/flow-vendor"
-commit = "7b9a635415eba5820f3d2d8dbca54ec21519a4a3"
+commit = "50060e8f7fbe3eabab911d4943a62698228c9f53"
 
 [[crate]]
 name = "axum"