[xscriptor]

Summary

Stacked dependency update on top of #198 (release/v1.0.2). Do not merge before #198; this PR is for review.

Changes

• Ran cargo update for the 13 remaining semver-compatible packages (cc, crc32fast, encoding_rs, log, rustix, unicode-width, utf8_iter, wasm-encoder, wasmparser, wast, wat, xattr and the new utf_types).
• Bumped the manifest floors for clap 4.6.7, console 0.16.6, image 0.25.10, serde 1.0.229, serde_json 1.0.154 and wat 1.263.0.
• Migrated from ureq 2.12 to 3.5.1:
  • AgentBuilder -> Agent::config_builder().
  • Error::Status/Error::Transport -> Error::StatusCode plus manual status handling where the response body is needed.
  • into_reader() -> Body::with_config().limit(...).reader().
  • Redirect and timeout settings moved to the ureq 3 config.
  • The wasm HTTP host now builds an http::Request and uses Agent::run, preserving arbitrary methods and bodies.
• Added a local HTTP server test for the wasm host operation (status, headers and body).

Verification

• cargo fmt --all --check: pass
• cargo check --all-targets: pass
• cargo test --locked: 239 passed, 1 ignored; 6 e2e tests passed
• cargo clippy --all-targets -- -D warnings: pass
• cargo audit --deny warnings: 0 vulnerabilities, 0 warnings
• xfetch --version: xfetch-cli 1.0.2
• xfetch update --check: works against the GitHub API (ureq 3 path)
• Normal xfetch run: works
• New local HTTP host test: pass

cargo update --dry-run now only keeps generic-array 0.14.7 (0.14.9 available, transitive through sha2 0.10/cranelift). No direct dependency remains outdated.

Notes

• Windows cross-compile was not run locally because x86_64-w64-mingw32-gcc is not installed. No Windows-specific code changed in this PR; the release workflow validates the Windows build.
• This PR is stacked on release: v1.0.2 security and dependency update #198 and should be reviewed before any merge.