[mostafa]

Summary

• Rolls up Dependabot PRs chore(deps): bump jsonschema from 0.48.5 to 0.56.0 #497 (jsonschema 0.56.0), chore(deps): bump dirs from 6.0.0 to 7.0.0 #496 (dirs 7.0.0), chore(deps): bump the actions-updates group across 1 directory with 5 updates #504 (GitHub Actions group), chore(deps-dev): bump the npm-updates group in /editors/vscode with 2 updates #502 (VS Code npm types), chore(deps-dev): bump @vscode/vsce from 3.9.2 to 4.0.0 in /editors/vscode #503 (@vscode/vsce 4.0.0), chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /editors/vscode #510 (brace-expansion 5.0.12), and chore(deps): bump markdown-it from 14.3.0 to 14.3.2 in /docs #511 (docs markdown-it 14.3.2) into one merge. Cargo.lock is regenerated against current main rather than replaying stale Dependabot bases. CI actions stay SHA-pinned.
• Security: brace-expansion 5.0.12 fixes Dependabot alerts 64, 65 (high), and 66 (moderate) in the VS Code extension; markdown-it 14.3.2 fixes alert 63 (moderate) in the docs site.
• The cargo audit and cargo deny failures on chore(deps): bump dirs from 6.0.0 to 7.0.0 #496 and chore(deps): bump jsonschema from 0.48.5 to 0.56.0 #497 were stale: they ran against the RUSTSEC-2026-0285 rustls advisory that fix(deps): rustls 0.23.45 and cargo-deny ignore cleanup #498 already fixed on main.
• @vscode/vsce 4.0.0 drops most of its transitive tree (hence the large package-lock.json shrink, matching chore(deps-dev): bump @vscode/vsce from 3.9.2 to 4.0.0 in /editors/vscode #503) and no longer depends on undici, so the undici override under @vscode/vsce is now inert.
• Held back: yamlpath 1.30.1 (chore(deps): bump yamlpath from 1.27.0 to 1.30.1 #495) and yamlpatch 1.30.1 (chore(deps): bump yamlpatch from 1.26.1 to 1.30.1 #494) pull tree-sitter-iter 1.28+, which requires rustc 1.97 and fails the 1.95.0 MSRV job. tikv-jemallocator 0.7.0 (chore(deps): bump tikv-jemallocator from 0.6.1 to 0.7.0 #425) stays out for the known musl daemon throughput regression.

Closes #497, closes #496, closes #504, closes #502, closes #503, closes #510, closes #511.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo check --locked --manifest-path fuzz/Cargo.toml
• cargo deny check and cargo audit
• cargo doc --workspace --all-features --locked --no-deps
• cargo test -p rsigma-runtime -p rsigma --all-features --locked
• zizmor --pedantic .github/workflows
• VS Code extension: npm ci, npm run compile, and tsc --noEmit
• npm run docs:build and npm run docs:validate from docs/
• CI green on all platforms