build: upgrade all dependencies to latest stable

[jahvari]

Summary

• upgrade every direct Rust dependency to its latest stable release and refresh the lockfile
• upgrade vendored UnRAR to 7.23 and 7-Zip to 26.02 from verified official source archives
• pin vcpkg to the peeled commit for the signed 2026.07.29 release and update GitHub Actions major versions
• adapt the librqbit backend to 9.0.0 while preserving listen-port fallback and persistent tracker storage
• expose the server control surface through the backend-neutral engine API so both libtorrent and librqbit feature builds compile
• keep agent architecture memory and implementation plans in the ignored local memory/ directory rather than GitHub
• harden Ubuntu dependency installation against the Azure apt mirror outage observed during this PR

Verification

• cargo outdated --workspace --root-deps-only --format json — no outdated direct dependencies in all 8 workspace packages
• cargo audit --no-fetch — 0 known vulnerabilities across 1,029 locked dependencies; 18 allowed transitive unmaintained/unsound warnings remain
• cargo test -p enginefs --features librqbit --no-default-features --locked --offline — 58 passed
• cargo clippy -p enginefs --all-targets --features librqbit --no-default-features --locked --offline -- -D warnings
• cargo test -p stremio-runtime-stub -p updater-helper -p settings-gui
• python -m unittest scripts.tests.test_generate_release_notes — 6 passed
• cargo metadata --locked --offline --no-deps --format-version 1
• workflow YAML parse and git diff --check
• forced native C/C++ compilation reached bindgen for both upgraded vendor trees

Audit findings fixed

• Important: librqbit 9.0.0 initially lost the configured 42000..=42009 listener fallback; restored with a bound-port regression test
• Important: librqbit tracker persistence was initially dropped when constructing the shared engine; restored with a supplied-storage regression test
• Important: the server crate's librqbit feature did not compile because server-facing engine controls were specialized to libtorrent; moved them to the backend contract, preserved libtorrent dispatch, and added a generic-control regression test
• Minor: the vcpkg workflow initially pinned an annotated tag object instead of its peeled commit
• Minor: the workflow initially lacked warnings-as-errors/all-targets Clippy coverage for librqbit
• Minor: stricter Clippy exposed a Unix desktop dialog fallback lint; simplified without changing behavior
• CI reliability: the Ubuntu Azure apt mirror stalled repeatedly; switched to the canonical archive with bounded retries/timeouts
• independent review of the final backend-control fix found no remaining critical, important, or minor issue and no new memory/concurrency/resource-lifetime risk

Residual gaps

• Windows release/vcpkg builds run only for tags/manual dispatch, not pull requests
• native RAR/7-Zip extraction does not have end-to-end fixture coverage
• librqbit lacks a high-concurrency streaming test
• there is no automated differential test against the installed server.js behavioral oracle
• the local Windows machine lacks vcpkg/libtorrent and libclang.dll, so complete native backend/server verification is delegated to this PR's provisioned GitHub Actions job

The workflow lints and tests both backend feature sets explicitly.