Bump 4 deps and fix man page font-run strip (v0.6.16)

[l1a]

What & why

Consolidates Dependabot #182 onto a gated branch so the release-hygiene steps Dependabot
bypasses — version bump, NOTES.md entry, man-page regen — actually happen. Same pattern as
#167 (v0.6.3), which rolled up #161/#163/#164.

While regenerating the man page for the version bump, the long-standing docs/retch.1
flip-flop between machines got root-caused, so the fix rides along here.

1. Dependency bumps (lockfile-only)

All four are patch-level and every spec is already a caret range, so Cargo.toml is untouched:

Crate	From	To
clap	4.6.4	4.6.5
clap_builder (transitive)	4.6.2	4.6.5
toml	1.1.3	1.1.4
toml_parser (transitive)	1.1.2	1.1.3
clap_complete	4.6.7	4.6.8
base64	0.23.0	0.23.1

The resulting Cargo.lock was diff-verified byte-identical to what Dependabot generated on
#182. base64 is graphics-feature-only, so just check's --features graphics clippy pass
(v0.6.5) is the leg that exercises it; the CI graphics-feature job (v0.6.7) covers the same
ground and was green on #182.

2. The just man font-collapsing sed has never worked — on any platform

mandown emits redundant \fB\fB…\fP\fP runs, and the man recipe carried
sed -e 's/\\fB\\fB/\\fB/g' -e 's/\\fP\\fP/\\fP/g' to strip them.

GNU sed reads \\f as the form-feed escape, not backslash-then-f. So the pattern only
ever matched form feeds — which groff output never contains — and the replacement would have
emitted a form feed had it matched. Confirmed against GNU sed 4.9 with a minimal fixture:
\fB\fB\-h\fP\fP goes in, comes out unchanged.

This corrects the diagnosis in v0.6.2, which recorded that the strip "didn't take effect on
Windows" and flagged the root cause as not reproducible without a Windows box. Linux was not
stripping anything either — its mandown build simply doesn't emit the doubled runs. The
difference was two mandown builds plus a strip that was dead code everywhere, which is exactly
why the committed page kept flipping depending on which machine last ran just man (v0.6.15
was generated on Windows and committed the doubled form, as v0.6.2 predicted).

Fixed by matching the backslash as [\] and carrying it out through a capture group
(s/[\]fB\([\]fB\)/\1/g), so no backslash escape appears on the replacement side at all.

retch-sysinfo unchanged at 0.1.51 — no Rust source touched.

Test plan

• just check — cargo fmt --check + cargo clippy --workspace -D warnings +
  cargo clippy --features graphics -D warnings
• cargo test --workspace — 57 sysinfo lib + 111 cli + 15 integration, all green
• just pr gate passes end to end (branch, version bump, NOTES header, man regen diff,
  Cargo.lock, fmt/clippy, tests, audit)
• Cargo.lock diff-verified byte-identical to PR deps(deps): bump the cargo-dependencies group across 1 directory with 4 updates #182's lockfile
• Fixed sed verified against a minimal fixture in GNU sed 4.9 (old expression = no-op,
  new expression collapses correctly)
• just man on Windows now produces a file byte-identical to the Linux-generated page
• Regenerated docs/retch.1 drops 21 doubled font runs and changes nothing else but the
  version footer (proved by normalising the previous page through the same collapse and
  diffing)
• cargo audit — no advisories beyond the pre-existing allowed paste unmaintained warning

Not applicable: README (no new feature, flag, or config key), docs/retch.md/tldr (no CLI flag
change), wiki (no config/theming, module-layout, or recipe-interface change — the man recipe's
documented behaviour is unchanged; only its internal strip was broken).

Closes #182.