chore(deps): advance every pin to what its vendor publishes today

[rldyourmnd]

Six of the seven harnesses had moved in the eighteen days since these pins were
written, and the consumed workflow library was forty-two commits behind. Each
vendor was asked what it publishes now, and every artifact the answer named was
downloaded and hashed rather than taken on the registry's word.

claude 2.1.241 -> 2.1.245 opencode v1.18.15 -> v1.18.23
codex 0.149.0 -> 0.149.1 cursor 2026.08.04-aaa8809 -> 2026.08.11-e8db854
pi 0.84.1 -> 0.84.3 antigravity 1.1.11 -> 1.1.20

Grok's wrapper had not moved but its baseline disagreed with itself: npm version
1.0.5 beside native packages and an installer argument still at 1.0.0. The
wrapper is the authority -- @xai-official/grok@1.0.5 pins all six platform
packages at 1.0.5 -- and asking the registry for latest instead would have
answered 0.1.220, because that line carries the tag while 1.0.x is published as
alpha.

The workflow library moves to 66fc19d6 (0.1.10). Every consumed reusable was
diffed across the gap first: no input was added as required, none was removed,
and every runner default is still ubuntu-latest -- which is the check that
matters, because a default belongs to the pinned commit rather than to us, and
inheriting a changed one would route fork pull requests onto private
infrastructure with no diff here to review.

syn 3.0.3 -> 3.0.4 was the only dependency behind; the other twenty-three are
already current, and the toolchain is already on stable 1.98.0.

The eighteen-row artifact table is no longer restated in prose. It went stale
between two audits a day apart, and SOFTWARE-LIFECYCLE.md now points at the
file that is measured and gives the command that prints it.

Found on the way, and recorded there: the previous audit updated Cursor's
installer digest without re-reading the version inside the script it had just
hashed, so the new digest sat beside the old version and four artifact digests
that belonged to a release that installer no longer installs. The installer
digest is unchanged today, which is what proves it.

Gate: cargo fmt --check, clippy -D warnings, 237 tests.