[Samfa12-tech]

Pocket DAW's Windows updater resolves rustls 0.23.40, which is affected by GHSA-2mjx-qc3c-rqvc. Patch the lockfile to rustls 0.23.46 and its required rustls-webpki 0.103.14 dependency, and identify the replacement source as 0.6.58 so the accepted, frozen 0.6.57 installer remains immutable.

Cargo resolution changed exactly those two dependency packages. Updater 2.10.1, reqwest 0.13.4, TLS provider/features, endpoint, certificate verification, updater signatures, capture, native audio and application behavior are unchanged. Remaining changes synchronize source-version and generated status metadata. No installer, installation, merge or publication is part of this draft.

Upstream references: rustls 0.23.46 release, handshake-boundary advisory, webpki 0.103.14. Version 0.23.46 also fixes the ECH regression in 0.23.45. Cargo initially selected webpki 0.103.15; the final lock uses the minimum required 0.103.14. Upstream describes 0.103.15 as a docs.rs build correction.

Validation on Windows against this exact source:

• Locked/offline Cargo tests: 224 passed, 0 failed, 6 existing manual diagnostic or external-fixture checks ignored.
• Locked/offline Clippy, all targets, warnings denied: passed. Cargo fmt check: passed.
• Windows contract: 347 passed across 32 files.
• Changed-source scope: 899 passed across 77 files; TypeScript no-emit passed. Initial browser launch failed because the harness used the default runtime directory; the identical scope passed after pointing to the already retained Chromium runtime. No assertions or source changed between those runs.
• Source-version, release-status, release-candidate truth, generated family governance, repository organization and security governance checks passed.
• Explicit locked Windows graph confirms the new rustls version through updater/reqwest and the existing ring provider. GLib 0.18.5 has no Windows-target reverse dependency; this does not resolve the separate cross-platform GLib advisory.
• Native capture fingerprint is unchanged. Existing exact-installer evidence remains bound to 0.6.57; it is not an installed 0.6.58 pass. Review and new exact-artifact gates remain required before publication.

No Chordsmith, DJ, Core or Godot source changes. No dependency PR is merged by this change.