fix(native): maintain exact GLib soundness backport with Linux coverage

[BunsDev]

Summary

• Apply the operator-authorized exact upstream two-line VariantStrIter fix to authenticated glib 0.18.5 source, retaining all 121 upstream files and licensing.
• Use a path patch with no dependency version upgrades or sibling source substitutions.
• Authenticate imported bytes and the separate upstream test lock; require original optimized SIGSEGV and all 11 patched iterator tests.
• Extend the existing Linux desktop job to verify source, exact Linux graph, optimized desktop build, and native library/RPC tests.
• Preserve frozen candidates, approval gates, and current Windows authority.

Provenance and maintenance

Upstream fix: gtk-rs/gtk-rs-core commit b5a4071e439bef2b5eea76c3aa25e5ae84839e34. Archive SHA-256: 233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5. Complete source/test-lock provenance and maintenance obligations are documented in vendor/glib-0.18.5.PROVENANCE.md. This is not a new upstream release; version-based advisory reporting may remain and no ignore/dismissal was added.

Validation and release boundary

Local source authentication, optimized upstream before/after reproduction on macOS, specification/authority regressions, typecheck, formatting, and independent review completed. The prior Linux Desktop job passed, but that head failed packaged provenance; fresh full CI is required after the refresh below. Relates to #188; do not close it solely on merge. Adoption into a protected release requires an authorized successor source/lock binding that also covers the new vendored source, not substitution into existing frozen candidates.

Provenance refresh

Signed merge 2a95a913dad46bc4f2f18a3945355bb4ea3805fb incorporates current main cfe8137 and the verified #203 repair. The reviewed merge tree is 61f014188e74516867cfbe2dc14801846d16d495. Typecheck, normal tests (598 passed / 61 skipped), heavy tests (569 passed / 35 skipped), lint, build and whitespace checks passed before commit. Independent review verified all 25 c544 authority pins and unchanged protected workflow/harness scripts. The lock remains identical to main, preserving the frozen packaged/protected source boundary while ordinary Desktop CI tests the vendored backport. Require complete exact-head CI before landing. Preserve chat and active worktrees.

[Copilot]

🟢 Approval recommended

The change set is narrowly scoped to the documented two-line fix plus robust provenance/CI enforcement, and the verification logic aligns with the stated acceptance criteria without introducing dependency upgrades.

Pull request overview

This PR vendors glib 0.18.5 into the repository and applies the exact two-line upstream VariantStrIter soundness fix (backported without changing the crate version), then adds CI/spec guardrails to ensure the maintained bytes and the optimized crash→pass regression are continuously verified—especially on Linux where the affected dependency graph exists.

Changes:

• Vendor glib 0.18.5 source into vendor/glib-0.18.5 and apply the upstream two-line VariantStrIter fix in src/variant_iter.rs.
• Patch the native src-tauri dependency graph to use the vendored glib via [patch.crates-io], updating Cargo.lock accordingly.
• Extend Linux CI and add a spec-guard test to enforce (a) source authentication and (b) optimized regression + dependency graph verification.

File summaries

File	Description
vendor/glib-0.18.5/src/variant_iter.rs	Applies the exact pointer-mutation fix (&mut p) to eliminate unsoundness in VariantStrIter.
vendor/glib-0.18.5.PROVENANCE.md	Documents provenance, hashes, and the maintenance/verification boundary for the backport.
scripts/verify-glib-backport.mjs	Verifies archive/test-lock hashes, enforces byte-for-byte vendor parity (except the two-line fix), and runs the optimized before/after regression.
.github/workflows/ci.yml	Adds Linux CI steps to run the verifier, validate Linux metadata graph resolution, and run native optimized regressions.
src/specification-guards.test.ts	Enforces presence/order of the new CI verification steps and the [patch.crates-io] binding.
src-tauri/Cargo.toml	Adds [patch.crates-io] glib = { path = "../vendor/glib-0.18.5" } to bind the native graph to the maintained source.
src-tauri/Cargo.lock	Removes registry source/checksum for glib 0.18.5 to reflect the path-patched resolution.

Review details

• Files reviewed: 4/128 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Linux backport validation completed on exact head 285fe96 in https://github.com/OpenCoven/chat/actions/runs/34449722487. Desktop job 102783350277 authenticated all 121 published files, reproduced the pristine optimized SIGSEGV, passed all 11 patched iterator tests, confirmed exactly one maintained GLib with registry sys/macro siblings, built the optimized desktop, and passed 158 native release tests (147 library + 2 Coven process-boundary + 9 native RPC). Web, E2E, contract canary, macOS Rust, both Unix supervisors, and Windows supervisor/native CI also passed.

The overall workflow is NOT green: Phase 1 real-authority conformance reports phase1.packaging.authority.failed. The same diagnostic occurs on main in run 34440807418/job 102755841745, but that baseline does not qualify this new source. No release gate was skipped or weakened. This PR remains unmerged: a reviewed integration decision and authorized successor source/lock binding must cover the path-patched Cargo files AND vendored GLib bytes before claiming protected release adoption. #188 remains open; no advisory dismissal.

[BunsDev]

Final integration confirmed: merged as 8d5215e after complete exact-head success on 2a95a91 in https://github.com/OpenCoven/chat/actions/runs/34456077153 . #203 resolved the earlier packaged authority failure; there are no unresolved review threads. This supersedes the previous unmerged/failing-CI comment. Protected successor candidate adoption remains separately tracked in #188; successful ordinary/packaged CI does not mean the existing frozen candidate contains this backport.