build(deps): pin rfd to tauri-plugin-dialog's major to unblock the cargo group (#1406)

The cargo-dependencies group PR (#1405) fails Rust Unit Tests on Linux:

    error: failed to run custom build command for `rfd v0.17.2`
    You need to choose at least one backend: `gtk3` or `xdg-portal`
    features for x86_64-linux

rfd is not really ours. It arrives in the tree via tauri-plugin-dialog,
which pins ^0.16; we declare it directly only for the fatal-startup
message box in lib.rs, where the Tauri app never finished building and
the plugin has no AppHandle to run a dialog through.

Cargo unifies features only within a semver-compatible version group, so
while both wanted ^0.16 there was a single rfd in the graph and the
plugin's backend features covered our `default-features = false`
declaration too. Bumping our direct dep to 0.17 forks rfd into two
crates: the plugin keeps 0.16.0 with its features, ours resolves to
0.17.2 with none, and rfd 0.17 added a build.rs assertion that aborts
the Linux build when no backend feature is set. Confirmed in the PR's
lockfile, which carries both 0.16.0 and 0.17.2.

Adding a Linux backend feature would be the wrong fix: it would paper
over the fork and still build rfd twice on every platform for one error
dialog. Our version has to track the plugin's instead, so ignore
semver-minor rfd updates (0.16 -> 0.17 for a 0.x crate) until
tauri-plugin-dialog moves. Patch updates inside 0.16.x still flow.

The remaining five crates in the group are unaffected; `windows` in fact
consolidates 3 versions down to 2.

Cargo.toml is comment-only here - no dependency, feature, or lockfile
change - so the build is untouched.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -75,6 +75,18 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
+      # declare it directly only for the fatal-startup dialog in lib.rs (there is
+      # no AppHandle yet, so the plugin API is unusable at that point). Cargo
+      # unifies features only within a semver-compatible group, so bumping our
+      # direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
+      # backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
+      # aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
+      # where it links, it just builds rfd twice. Our version must track the
+      # plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
+      # Patch updates within 0.16.x still flow through.
+      - dependency-name: "rfd"
+        update-types: ["version-update:semver-minor"]
 
   # GitHub Actions
   - package-ecosystem: github-actions

Client/tauri-client/src-tauri/Cargo.toml

@@ -93,6 +93,14 @@ zeroize = "1"
 # Encodes the DPAPI ciphertext for the JSON fallback store. Already in the tree
 # via the tauri/rustls stack, so this costs no extra build.
 base64 = "0.22"
+# Native message box for the fatal-startup path in lib.rs, where the Tauri app
+# never built and tauri-plugin-dialog has no AppHandle to run through. Already
+# in the tree via that same plugin, so this costs no extra build -- but only
+# while the versions match: the plugin pins ^0.16, and Cargo unifies features
+# only within a semver-compatible group. Moving this to 0.17 forks rfd into two
+# crates, and the copy without the plugin's backend features fails rfd 0.17's
+# build.rs on Linux. Pinned to the plugin in .github/dependabot.yml; bump both
+# together or neither.
 rfd = { version = "0.16", default-features = false }
 
 # Desktop-only plugins (no mobile bundle target). single-instance carries the