Prepare 2026.0.40 candidate with leaf dependency refresh

[sergiopesch]

Summary

master (public 2026.0.39 + #27)
  └─ 2026.0.40 candidate
       ├─ version metadata → 2026.0.40
       └─ leaf deps (not Tauri/GTK, not React)
            cargo: serde 1.0.229, log 0.4.34, inotify 0.11.5, cc 1.4.6
            npm:   zustand 5.0.15, eslint 10, @tailwindcss/vite 4.3.3

Public download and unsigned tag voco.2026.0.39 stay as they are. This PR is a private candidate, not a public cut.

Supersedes Dependabot #18, #19, #21, #22, #24, #25, #26 after merge. Leaves #5, #6, #16, #20, #23 off this branch.

Evidence

• Before: tree version 2026.0.39 on master; leaf npm/cargo PRs held off the public line.
  After: npm run verify:versions reports 2026.0.40; npm run check and npm run lint pass; desktop vitest 411 passed / 2 skipped; cargo test --locked 325 lib + 19 browser-host + 7 glib iterator tests passed; cargo clippy --locked -- -D warnings finished clean for VOCO.

Merge Danger

Door: two-way (revert the PR; do not move voco.2026.0.39)
Blast Radius: native and frontend bytes change, so any later package needs a new 2026.0.40 qualification. Installer URLs in this tree point at a tag that does not exist yet. Tauri/WebKit and serde_with remain separate until a GTK/WebKit check. Not a signed or public release.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.