fix: port PR #208 dependency train to current main

[andrei-hasna]

Why

PR #208 is based on a stale pre-upstream-merge base and includes a state/BUILD.bazel hunk that has already landed independently. The remaining dependency/API updates still apply to current main and need a narrow replacement that preserves terminal output and deterministic prompt behavior.

This supersedes #208 and carries forward the still-relevant work from #195, #196, #197, and #198.

What changed

• update chardetng to 1.0 and preserve valid UTF-8 and terminal escape sequences while denying ISO-2022-JP detection
• update direct constant_time_eq to 0.5.0, resolve Rustls 0.23.41, and update whoami to 2.1.2
• handle fallible whoami lookups with deterministic fallback behavior
• add regressions for ESC(B/J), CSI, OSC, UTF-8 plus ANSI, malformed/binary output, and username fallback
• regenerate Cargo and Bazel lockfiles

The already-landed state/BUILD.bazel runtime-fixture change is intentionally excluded.

Verification

• focused Rust 1.96.1 checks passed for protocol, core, app-server transport, Rustls provider, and client
• protocol encoding/terminal regressions passed
• deterministic username fallback regression passed
• Bazel lock update/check and scoped just fix passed
• workflow-matching locked debug CLI artifact built and passed wrapper/version/archive smoke
• exact seven-file remote/local hashes matched; committed diff and staged secret scans found no credentials

Merge gate

The optimized Cargo release build exceeded the 8 GB E2B worker memory limit while compiling unchanged codex-app-server-protocol, including with one build job, and emitted no Rust diagnostic. Do not merge until exact-head hosted CI is green and codewith-cli.yml is manually dispatched for this frozen branch with profile=release, producing a successful wrapper smoke and release archive.

No documentation changes are required.