Track glib unsoundness in the Linux Tauri dependency graph

## Summary

`console/src-tauri/Cargo.lock` resolves `glib 0.18.5`, which is affected by GHSA-wrw7-89jp-8q8g / RUSTSEC-2024-0429 (unsound `VariantStrIter` iterator implementations; patched in glib 0.20.0).

This dependency is present only in the Linux/BSD desktop graph. Windows and macOS targets do not include glib.

## Dependency chain

```text
qwenpaw-desktop
└─ tauri 2.11.1
├─ gtk 0.18.2
├─ webkit2gtk 2.0.2
├─ tauri-runtime-wry
└─ tray-icon / muda
└─ glib 0.18.5
```

## Verified blocker

A direct update is impossible because GTK 0.18 requires glib ^0.18:

```text
cargo update -n -p glib@0.18.5 --precise 0.20.0
failed to select a version for glib = ^0.18
required by gtk v0.18.2
```

Updating Tauri from 2.11.1 to the current 2.11.5 does not resolve it; Tauri 2.11.5 still declares Linux `gtk = 0.18`.

Adding a direct glib 0.20 dependency would only install a second version and would not replace GTK's vulnerable 0.18 graph. Vendoring a private 0.18 backport would add long-term supply-chain maintenance and would not satisfy version-based scanners.

## Proposed path

Track the Tauri/GTK migration that adopts glib >=0.20, then update the desktop dependency graph and validate on a Linux runner.

Required validation after an ecosystem-compatible release exists:

```bash
cargo tree --locked --target x86_64-unknown-linux-gnu -i glib
cargo audit --file Cargo.lock
cargo check --locked --target x86_64-unknown-linux-gnu
cargo build --locked --target x86_64-unknown-linux-gnu
```

Also smoke-test the Linux WebView, tray, native dialog, and shutdown paths.

Until then, this should be documented as a Linux-only upstream ecosystem blocker, not reported as fixed. If Linux desktop is not currently shipped, a target-scoped scanner exception can be considered, but the source dependency remains unresolved.