Update Tauri 2.11.1 on the vendored glib 0.18.5 patch

[sergiopesch]

Summary

#28 2026.0.40 candidate (version + leaf deps)
  └─ this PR
       tauri 2.10.3 → 2.11.1
       tauri-build 2.5.6 → 2.6.3
       wry 0.54.4 → 0.55.1
       tao 0.34.8 → 0.35.3
       @tauri-apps/api 2.10.1 → 2.11.1
       serde_with 3.18.0 → 3.23.0
       glib 0.18.5 vendored patch: still the only copy
       gtk 0.18.2 / webkit2gtk 2.0.2 unchanged

Stacked on #28. Public 2026.0.39 and unsigned tag voco.2026.0.39 stay put. Do not add glib 0.20.

Supersedes Dependabot #5, #6, #20, #23 after merge. React #16 stays closed off this candidate.

Evidence

• Before: tauri 2.10.3 / wry 0.54.4 / serde_with 3.18.0 on patched glib 0.18.5.
  After: python3 scripts/verify-glib-backport.py → one glib 0.18.5 path copy, 121 source files, fix commit b5a4071e; python3 scripts/test-glib-variant.py 7/7 optimized iterator tests passed; cargo test --locked 325 + 19 + 7; cargo clippy --locked -- -D warnings clean; npm run check / lint / desktop vitest 411 passed; cargo audit no longer reports the Tauri origin or serde_with KeyValueMap findings. Rand RUSTSEC-2026-0097 remains (log feature still disabled).

Merge Danger

Door: two-way (revert this PR; do not move voco.2026.0.39)
Blast Radius: native WebView/tray bytes change (tray-icon 0.23 also pulls dbus). Isolated glib/GTK regression is not physical desktop, compositor or application qualification. Merge only after #28. Not a signed or public release.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.