test: refresh shell title release gate

[saagpatel]

What

Refreshes AssistSupport shell-title UI expectations, the macOS visual baseline for the branded page title, CI-aligned dependency metadata, Rust security-audit remediation, final CI workflow drift, and the generated Search API contract exposed by the release gate.

Why

The release gate was failing because the app now renders AssistSupport/Workspace and AssistSupport/Knowledge, while Playwright still expected bare page names. Follow-up CI also exposed package-manager lockfile drift, fresh RustSec advisories, a search-health workflow missing the package command runner, a duplicate build-timing check that was noisy under the broad quality gate, and stale generated OpenAPI output.

How

Updates responsive assertions to match the branded shell title, regenerates the visual snapshot, regenerates pnpm-lock.yaml with CI's pnpm version, upgrades the DNS/compression Rust dependencies that had direct fixes, documents temporary waivers for remaining upstream-only Rust warning advisories, gives the Search API health job pnpm access, leaves build timing to the dedicated perf-build lane, and refreshes openapi.generated.json from the current generator.

Testing

• Local checks passed: CI-shaped frozen install, high-severity JavaScript dependency audit, Rust security audit, backend tests/security regression, Search API tests/OpenAPI check, UI smoke/visual/a11y/responsive checks, workflow drift, version parity, policy checks, YAML parse, and git safety checks
• Earlier full release gate passed locally before the final lockfile, Rust security, CI workflow, and generated-contract alignment

Lockfile rationale

The lockfile changed because CI uses pnpm 10.28.1 and rejected the prior lockfile config during frozen install. Regenerating the lockfile with pnpm 10.28.1 aligns GitHub Actions with the committed dependency configuration while preserving the audit overrides needed to clear high-severity dev-tooling advisories.

Performance impact

No product performance impact; UI expectation, snapshot, dependency metadata, audit hygiene, generated contract, and CI workflow cleanup only.

Risk / Notes

This is release-gate cleanup only. No product behavior is intentionally changed. The Rust audit script keeps documented temporary waivers for upstream transitive warnings that still need follow-up through the existing dependency-tracking process.

Tauri alignment

Aligns the Rust-side Tauri core, build, and dialog plugin versions with the JavaScript packages so the macOS build gate no longer sees a JS/Rust version mismatch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edcf66e24a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Match the rendered breadcrumb spacing

With the current RevampShell markup, .as-shell__pageTitle is rendered as separate spans with whitespace around the slash, and Playwright normalizes that text to AssistSupport / Workspace, not AssistSupport/Workspace. This refreshed expectation still fails the shell-title gate (the new Knowledge expectations in the responsive spec have the same issue), so include the spaces or assert the active crumb separately.

Useful? React with 👍 / 👎.