chore(deps): update app, SDK, website, and CI dependencies

[kitlangton]

Why

Several dependencies across the app, SDK workspace, website, and CI had fallen behind, including Effect's 4.0.0 final release, rubato 5, Vitest 5, Changesets 3, and new major versions of most GitHub Actions.

What Changes

Rust app

• All semver-compatible updates (cargo upgrade plus cargo update; 168 lockfile changes), including clap, cpal 0.18.2, regex 1.13, serde, and libc.
• rubato 0.16 → 5.0: src/dictation.rs moves from FftFixedIn to Fft::new_custom with the same window (Blackman-Harris²), chunk size, and single sub-chunk, behind a small resample_chunk helper. Partial chunks use Indexing::partial_len, and an empty partial chunk flushes the delay as before.
• dirs 7, base64 0.23, ed25519-dalek 3, and x11rb 0.14. dirs' macOS and Linux path code is unchanged from 6, so ~/Library/Application Support/voice-control is unaffected.

SDK workspace

• Effect 4.0.0-rc.112 → 4.0.0 in @hex/commands and the personal-commands workspace template. HEX already migrates existing workspaces to the SDK's required Effect pin. The published @kitlangton/hex peer range (>=4.0.0-rc.112 <5.0.0) already admits 4.0.0 and is unchanged, so no changeset is needed.
• Effect 4.0.0's Effect.isEffect now narrows to Effect<unknown, unknown, unknown>, so the handler registration casts to the declared handler type. Its timeout error message changed from TimeoutError to Operation timed out after '0', so the host test matches "timed out".
• Vitest 5, @types/bun 1.4.2, @types/node 24.19, and Changesets 3 (the config needs no changes).

Website: motion 14, React 19.3, three 0.186, Vite 8.3, @vitejs/plugin-react 6.1, and matching types.

CI: checkout v7, setup-node v7, cache v6, Pages actions v6/v5/v5, magic-nix-cache v15, and changesets/action v2, whose renamed publish-script and pr-title inputs and default github-token replace the old publish, title, and GITHUB_TOKEN env.

Scope

Not updated: metal, core-video, and core-graphics-types must stay on gpui 0.2.2's versions (it is already the latest gpui), and gtk must stay on 0.18 for the unmaintained gtk-layer-shell 0.8. libc is held at 0.2.189: 0.2.190 removed Linux ENOATTR, which gpui's zed-async-tar → xattr 0.2.3 still uses, so the Linux build failed in CI. transcribe-cpp (0.1.3 → 0.2.4) and screencapturekit (8 → 11) follow in separate PRs because they change transcription and meeting capture. flake.lock is untouched because Nix is not installed here.

Verification

cargo fmt --check
cargo clippy --all-targets --all-features -- -D warnings
cargo +1.99.0 clippy --all-targets -- -D warnings
cargo test
./scripts/smoke-commands-workspace.sh
cd sdk/typescript && bun run check && bun run test && bun run build
cd sdk/commands && bun run check && bun run test && bun run build
cd site && bun run build

• 492 Rust tests passed (12 ignored); both Clippy runs were clean.
• rubato: a temporary test (not committed) ran a two-tone signal at 48 kHz and 44.1 kHz through the new Recording path and through rubato 0.16's FftFixedIn with the same chunking. Lengths matched exactly, and the maximum sample difference was 1.8e-7 and 2.4e-7.
• ed25519-dalek 3, base64 0.23, and x11rb 0.14: these modules compile only on Linux, so a temporary macOS crate exercised the exact updater signature calls (sign, encode, decode, strict verify, wrong-key rejection) and type-checked every x11rb call the X11 listener and paste code use. Linux CI is the real compile and test.
• SDK: 70 and 52 tests passed, and the commands-workspace smoke migrated a 4.0.0-beta.107 workspace and type-checked it. bunx changeset status runs under Changesets 3.
• Website: built with no console errors, and a Playwright screenshot of the local preview matched production.
• The changesets/action v2 release path can only be exercised by the next SDK release.