fix: port PR #208 dependency train to current main

[andrei-hasna]

Why

PR #208 is based on a stale pre-upstream-merge base and includes a state/BUILD.bazel hunk that has already landed independently. The remaining dependency/API updates still apply to current main and need a narrow replacement that preserves terminal output and deterministic prompt behavior.

This supersedes #208 and carries forward the still-relevant work from #195, #196, #197, and #198.

What changed

• update chardetng to 1.0 and preserve valid UTF-8 and terminal escape sequences while denying ISO-2022-JP detection
• update direct constant_time_eq to 0.5.0, resolve Rustls 0.23.41, and update whoami to 2.1.2
• handle fallible whoami lookups with deterministic fallback behavior
• add regressions for ESC(B/J), CSI, OSC, UTF-8 plus ANSI, malformed/binary output, and username fallback
• regenerate Cargo and Bazel lockfiles

The already-landed state/BUILD.bazel runtime-fixture change is intentionally excluded.

Verification

• focused Rust 1.96.1 checks passed for protocol, core, app-server transport, Rustls provider, and client
• protocol encoding/terminal regressions passed
• deterministic username fallback regression passed
• Bazel lock update/check and scoped just fix passed
• workflow-matching locked debug CLI artifact built and passed wrapper/version/archive smoke
• exact seven-file remote/local hashes matched; committed diff and staged secret scans found no credentials

Merge gate

The optimized Cargo release build exceeded the 8 GB E2B worker memory limit while compiling unchanged codex-app-server-protocol, including with one build job, and emitted no Rust diagnostic. Do not merge until exact-head hosted CI is green and codewith-cli.yml is manually dispatched for this frozen branch with profile=release, producing a successful wrapper smoke and release archive.

No documentation changes are required.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

Codewith Coordinator seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[andrei-hasna]

Superseded by #253. The code tree and parent are identical; #253 corrects the commit author to the established CLA-signed contributor identity without force-pushing this branch.