fix(build): repair root workspace and sync stale Cargo.lock

[adamgell]

Problem

main's Check & Test (Rust) gate is red on the cargo audit step (it stays hidden until the earlier cargo deny step passes). Root cause: the tracked root Cargo.lock has been orphaned since the v1.3.2 release.

src-tauri/Cargo.toml carried a leftover empty [workspace] table that detached it from the root workspace. With src-tauri both declaring its own workspace and listed as a root member, cargo update at the root fails:

error: multiple workspace roots found in the same workspace

So the root lockfile could never be refreshed. It still pinned evtx 0.11.2 even though the manifest now requires evtx = "0.12", and cargo audit (which reads that stale root lock) failed on 5 vulnerabilities that aren't in what actually builds and ships (CI builds resolve a fresh lock inside src-tauri):

• RUSTSEC-2026-0204 — crossbeam-epoch <0.9.20
• RUSTSEC-2026-0194 / RUSTSEC-2026-0195 — quick-xml <0.41

Changes

• Remove the obsolete empty [workspace] from src-tauri/Cargo.toml so the root workspace resolves and the single root Cargo.lock is maintainable again. The tracked root Cargo.toml already shields against the worktree parent-capture case the old comment guarded against.
• Pin build.target-dir to src-tauri/target in .cargo/config.toml so making src-tauri a member doesn't relocate build output. Every release / nightly / CI artifact + cache path (all reference src-tauri/target/...) keeps working with no workflow edits.
• Minimally sync Cargo.lock: evtx 0.11.2 → 0.12.2 (manifest requirement) and crossbeam-epoch 0.9.18 → 0.9.20 (fixes RUSTSEC-2026-0204). The webview stack (tauri / wry / tao unchanged) is deliberately left alone — this is a lockfile-sync, not a dependency-modernization.
• Add .cargo/audit.toml ignoring RUSTSEC-2026-0194/-0195 for the remaining quick-xml <0.41, which enters transitively via plist (Tauri) and the Linux wayland-scanner build tooling and can't be bumped without moving the Tauri stack. Mirrors the entries already in src-tauri/deny.toml.

Verification

Local (macOS): cargo check, cargo test (64 passed), cargo clippy -- -D warnings, cargo check --no-default-features, cargo deny check, and cargo audit all pass. CI confirms across Linux/Windows/macOS.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR repairs the Rust workspace layout so the repository uses a single, maintainable root Cargo.lock, unblocking CI’s cargo audit gate by ensuring the lockfile matches what actually builds in src-tauri.

Changes:

• Removes the obsolete empty [workspace] table from src-tauri/Cargo.toml to eliminate the “multiple workspace roots” conflict.
• Adds .cargo/config.toml to pin Cargo build artifacts to src-tauri/target even when building from the workspace root.
• Updates the root Cargo.lock (notably evtx and crossbeam-epoch) and adds .cargo/audit.toml to mirror the existing quick-xml advisory ignores.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src-tauri/Cargo.toml	Removes the local workspace root so src-tauri participates in the root workspace/lockfile.
Cargo.lock	Synces the root lockfile to current manifest requirements and relevant security fixes.
.cargo/config.toml	Pins target-dir to src-tauri/target to preserve existing artifact/cache paths.
.cargo/audit.toml	Configures cargo-audit ignores for advisories that can’t be resolved without upgrading the Tauri stack.
src-tauri/deny.toml	Aligns advisory ignore commentary for quick-xml with the new audit configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.