fix(deps): resolve memmap2 and rkyv advisories for #815

[H-Chris233]

Summary

• upgrade enigo from 0.2 to 0.3 in the main app and backend test workspace
• resolve the Linux chain to enigo 0.3.0 -> xkbcommon 0.8.0 -> memmap2 0.9.11
• update rkyv and rkyv_derive from 0.8.16 to 0.8.17
• establish Rust 1.88 as the package MSRV and verify it alongside latest stable on macOS, Windows, and Linux CI
• refresh the stale FFI comment while leaving runtime behavior unchanged
• leave the GTK3/glib migration and RustSec ignore policy unchanged

Both rkyv 0.8.16 and rkyv 0.8.17 declare Rust 1.81, so this security update does not itself raise rkyv's MSRV. Rust 1.88 matches the highest declared MSRV in the current locked dependency graph; latest stable remains the recommended development toolchain.

This is the first-phase dependency fix for #815. It intentionally does not close the issue because the GTK3/glib chain and Linux runtime smoke testing remain tracked there.

Validation

• cargo tree --locked --target x86_64-unknown-linux-gnu -i memmap2 for both manifests
• cargo audit 0.22.2 for both lockfiles: zero vulnerabilities; the memmap2 and rkyv advisories are gone
• cargo +1.88.0 metadata --locked --no-deps for both manifests
• cargo +1.88.0 check --locked for the main app
• cargo +1.88.0 test --locked --manifest-path backend-tests/Cargo.toml --no-run
• stable cargo check --locked for the main app
• stable cargo test --locked --lib --no-run for the main app on Windows
• Linux backend harness supplies pure Rust fcitx fallback stubs, avoiding DBus/runtime coupling in this test crate
• paste_keys_match_configured_shortcut: passed
• polish_output_honors_chinese_script_preference: passed
• backend test workspace: 182 passed; one Windows symlink-permission test skipped
• workflow YAML parse and git diff --check

CI

The desktop matrix keeps latest stable as the default toolchain and additionally installs Rust 1.88.0. Every macOS, Windows, and Linux job now:

• runs the existing full stable test suite
• runs the main app locked check with Rust 1.88.0
• compiles the backend test workspace with Rust 1.88.0

The CI run for commit 5db682d9 is pending.

Remaining validation

Linux X11 and Wayland insertion smoke tests for Ctrl+V, Ctrl+Shift+V, Shift+Insert, and clipboard fallback remain tracked in #815 and are not a merge gate for this first-phase dependency PR.

Audit notes

The main lockfile retains 18 allowed warnings, including the expected GTK3/glib chain and the pre-existing event-listener 5.4.1 / RUSTSEC-2026-0221 warning. The backend test lockfile retains the unrelated allowed warning anyhow 1.0.102 / RUSTSEC-2026-0190. No RustSec ignore was added.

Relates to #815.