chore(mesh): upgrade MeshLLM to 0.76.2

[micspiral]

Summary

Upgrade Buzz from MeshLLM v0.76.0-rc9 to the latest stable v0.76.2 release (via v0.76.1).

• Update all eight Mesh git dependencies across desktop and relay smoke examples; both lockfiles resolve all 47 Mesh packages to a0c1e66b0ac037dd56544b9e2d94969ea43d694f (tag v0.76.2). All non-Mesh lock records are unchanged by the 0.76.1 → 0.76.2 bump.
• Match Mesh's ed25519-dalek = 3.0.0 and rusqlite = 0.40 dependencies.
• Explicitly enable rusqlite's fallible_uint feature, preserving Buzz's existing u64 SQL conversions when mesh is disabled. Mesh-enabled builds previously supplied this transitively, so testing both configurations matters.
• Temporarily pin only the optional sqlx-sqlite package to the merged upstream compatibility fix transact-rs/sqlx#4402, revision 94aafe3a68884d923b0798a767c8d7f6cfda89d2. SQLx 0.9.0 caps libsqlite3-sys below 0.38, while Mesh 0.76 requires 0.38. Cargo resolves the conflict even with SQLite disabled. The fix raises that upper bound; remove the patch once released. Buzz's active PostgreSQL driver stays on crates.io SQLx 0.9.0.
• Preserve the explicit Linux keyring 3 crypto-rust feature so Secret Service sessions retain DH encryption independently of Mesh keyring 4.
• Preserve the dedicated examples-only buzz-mesh-smoke crate and lifecycle workflow wiring, keeping Mesh/native-runtime dev dependencies out of relay CI builds.
• v0.76.1 → v0.76.2 upstream delta: self-updater fix for composed product-v2 bundles (fix(autoupdate): install composed product-v2 bundles in the self-updater Mesh-LLM/mesh-llm#1844) plus release plumbing — no API changes affecting Buzz.
• Merged origin/main (7c789dee0) without rewriting shared PR history.

Validation at ae4adba15 (local macOS ARM64, Hermit toolchain)

• Passed: cargo test --locked -p buzz-mesh-smoke --all-targets (all six example harnesses compile; no live harness execution).
• Passed: desktop Tauri workspace tests, both default and --features mesh-llm graphs (3,296 tests with mesh enabled, 0 failures).
• Passed: just desktop-tauri-clippy (both feature graphs, -D warnings), root workspace clippy -D warnings, cargo fmt --all --check.
• Passed: --locked metadata resolution for both workspaces; lockfile diff audited to touch only Mesh package records.
• Passed: full pre-push hook suite on the final push (branch-skew, rust-tests, desktop-tauri-checks, file-size-check) — no hooks bypassed.
• Not run: live Mesh inference/admission smoke or installed-app UI exercise. CI lifecycle smoke coverage applies.

Originating Buzz conversation: buzz://message?channel=dffbc117-845a-4c02-bc3f-eaeeefc4deaa&id=670f9c262e1ec0a4df5600b3173a0c5de2abe17e08ba9ccfdd8eff109fadf1a8

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is d01e5f82058463709a22e93bb4cd795da5f53e10...3610484de223da2964f6527224c75541b96c01b2.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 3610484de223da2964f6527224c75541b96c01b2 to authorize a new review.
Any previous review applies only to its recorded range.

[michaelneale]

🤖 Merged origin/main (77729ab) into this branch to clear the Cargo.lock conflict. Resolution keeps main's four bumps (async-utility 0.3.2, chacha20 0.10.2, der 0.8.2, spin 0.9.9/0.10.1) alongside the existing Mesh v0.76.2 records; no other lock entries changed vs the previous head. Verified locally at f7b126f: cargo metadata --locked (both workspaces), cargo test -p buzz-mesh-smoke, desktop tauri tests with --features mesh-llm (3,314 pass), clippy -D warnings root + desktop, full pre-push lanes green.

[michaelneale]

Merged origin/main (d01e5f8) and re-resolved the root Cargo.lock (main's appattest → openssl 0.10.80 / openssl-sys 0.9.116 records restored at main's exact versions; no Mesh records changed). Still on MeshLLM v0.76.2 — that is the current latest release.

CI on 3610484: all green. Desktop Smoke E2E (4) needed one rerun — video-attachment.spec.ts right-click menu test failed 3/3 attempts on the first run and passed on rerun; this PR touches no desktop source or e2e files.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

P3: update the moved examples’ usage commands. All six headers still tell operators to use cargo run -p buzz-relay --example ..., but buzz-relay no longer owns those targets, so the documented command fails. Replace the package with buzz-mesh-smoke in all six headers. The executable Justfile and CI callers are already correct. This is non-blocking.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No blocking code findings

Reviewed head 3610484de223da2964f6527224c75541b96c01b2 against base d01e5f82058463709a22e93bb4cd795da5f53e10. No blocking regression found in dependency/feature alignment, SQLite patch scope, identity/admission integration, runtime/model API compatibility, or smoke relocation. This is a review comment, not an approval.

• Non-blocking follow-up: correct the six moved examples’ usage headers (P3 finding). Executable Justfile and CI callers are already correct.
• Operational caveats, not blockers: split-stage protocol generation changes from 6 to 8. Upstream capability checks and split participant selection exclude incompatible peers; upgrade split-serving participants together. Bundled-runtime startup now also consults the release catalog, with a 60-second per-request timeout and bundle fallback on catalog failure. It can prefer/download a better GPU runtime; an adjacent bundle no longer implies network-free startup.
• Validation: lifecycle CI passed real relay discovery, trusted inference, outsider rejection, and continued trusted inference. Desktop CI passed default tests and 3,339 Mesh-enabled library tests; Windows all-target checks also passed. The checked-out CI merge fdf9fa2 has the identical tree to reviewed head (63fe9570). No suites were duplicated locally. Installed-app UI, GPU/split execution, and live OS-keyring upgrades remain unverified here. The security bot’s existing review is explicitly stale, not current-range evidence.