chore: bump 3 deps (consolidated Dependabot #188)

[l1a]

Consolidates Dependabot #188 onto a gated branch so the release hygiene it bypasses —
version bump, NOTES entry, man regen — is actually done. Same pattern as #167 (v0.6.3) and
#184 (v0.6.16). Supersedes #188, which should be closed on merge.

Dependencies

All patch-level and lockfile-only — every spec is a caret range, so both Cargo.toml
manifests are untouched:

Crate	From	To	Note
clap	4.6.5	4.6.6	pulls clap_builder 4.6.5 → 4.6.6
clap_complete	4.6.8	4.6.9
rusqlite	0.40.1	0.40.2	pulls libsqlite3-sys 0.38.1 → 0.38.2

The lockfile was diff-verified byte-identical to Dependabot's before the version bump, so
this carries exactly the change #188's green CI validated. Afterwards the only divergence is
retch-cli's own version line — confirmed by diffing against refs/pull/188/head:Cargo.lock:

1554c1554
< version = "0.6.18"
---
> version = "0.6.19"

Why rusqlite got a live check, not just a green suite

rusqlite is a direct dependency of retch-sysinfo and is the crate that v0.6.18's
Packages fix had just started using differently — open_with_flags with
SQLITE_OPEN_READ_ONLY | SQLITE_OPEN_URI | SQLITE_OPEN_NO_MUTEX over a file:…?immutable=1
URI. libsqlite3-sys also bundles SQLite itself, so this bump changes the engine that has to
honour immutable=1.

The rpm_db_uri unit tests only assert string construction, so they could not catch a
behavioural change there. Verified live as an unprivileged user: Packages: 2509,
unchanged.

Any future rusqlite / libsqlite3-sys bump deserves the same one-command check —
retch --fields packages without sudo. Noted in NOTES.

Versions

retch-cli → 0.6.19. retch-sysinfo unchanged at 0.1.53 — no source change, only its
transitive lockfile deps moved (same call as v0.6.3).

Test plan

• just check — fmt + clippy --workspace + clippy --features graphics, clean
• cargo test --workspace — 69 cli + 117 sysinfo + 15 integration, green with and without --features graphics
• just man — regenerated; diff is the version footer only, 0 doubled font runs
• Lockfile diff-verified byte-identical to Dependabot's before the version bump
• rusqlite 0.40.2: retch --fields packages unprivileged → Packages: 2509, unchanged
• clap_complete 4.6.9: completions still generate for all six shells (bash 90, zsh 63, fish 28, nushell 37, elvish 55, power-shell 61 lines)
• just pr — full gate green

No runtime behaviour change.