chore(deps): refresh Rust dependencies and migrate to starbase 0.13

[DamianReeves]

Summary

Rust half of the dependency refresh. Takes the updates from Renovate's renovate/rust branch (#638) and carries them to green — which that PR could not do on its own.

Supersedes #638.

Why #638 was stuck

Its renovate/artifacts check fails with "Artifact file update failure": Renovate could not regenerate Cargo.lock, so it shipped manifest bumps with no lockfile. Since #678 added --locked to CI, that combination now fails outright rather than silently re-resolving.

The artifact failure was caused by the toml_datetime conflict fixed in #677. Confirmed: applying #638's manifests and running cargo update now resolves cleanly (exit 0). Renovate should be unblocked going forward.

The extism workaround is gone

#677 downgraded proc-macro-crate to 2.0.0 to free toml_datetime so extism could reach 1.13. A full cargo update now reaches a strictly better state:

Package	Before	After
extism	1.13.0	1.30.0
extism-manifest	1.13.0	1.30.0 (matched)
wasmtime	37.0.3	43.0.2
proc-macro-crate	2.0.0 (downgraded)	2.0.2 (stock)

wasmtime 43 doesn't require toml_datetime >= 0.6.5, so the conflict simply doesn't arise. The downgrade is dropped — the extism fix is now structural rather than a pinned workaround that a future cargo update could undo.

starbase 0.10 → 0.13

The only source breakage in the entire refresh (E0107 was the sole error code across the full workspace check). Four distinct API changes:

1. AppResult gained a generic error parameter. 0.10 defined it as miette::Result<Option<u8>>, so AppResult<miette::Report> preserves the previous semantics exactly — 23 return types across 12 files.
2. AppSession gained an associated Error type — type Error = miette::Report;
3. MainResult is now behind an opt-in miette feature (default = ["tracing"]) — enabled in the workspace manifest. It wasn't removed, just gated.
4. App::run returns AppRunOutcome, not a Result — migrated to .into_miette_result().

Point 4 is a small behavioral improvement: the old ? path went through miette's default handling, which always exits 1 on error. into_miette_result() preserves the real exit code. Commented at the call site.

Verification

Every CI cargo step run locally with --locked, matching what CI now enforces:

Check	morphir	morphir-live
cargo fmt --check	pass	pass
cargo clippy --locked --all-targets -- -D warnings	pass	pass
cargo test --locked	pass	pass
cargo build --locked --release	pass	pass
cargo build --locked --release --features desktop	—	pass

Plus cargo test --locked --workspace — pass. 10/10.

The desktop build is verified locally for the first time (GTK dev libraries now installed), which matters here since this refresh moves wasmtime 37→43 and touches the whole dioxus/GTK chain.

Scope

Rust only. The other three ecosystems remain with Renovate/Dependabot: #634 (npm major), #626 (GitHub Actions major), #675 (mise tools), #670 and #632 (website npm).

[netlify]

✅ Deploy Preview for angry-raman-7c44f6 canceled.

Name	Link
🔨 Latest commit	5e73cf0
🔍 Latest deploy log	https://app.netlify.com/projects/angry-raman-7c44f6/deploys/6a8b9780cd130e0008272dd6