[rgdevment]

Lands the five open Dependabot PRs as one change, so they merge and get tested together.

What changed

• Rust (chore: bump global-hotkey from 0.8.0 to 0.9.0 in the rust-majors group #81): global-hotkey 0.8 → 0.9 (major). It builds with no change to crates/linkunbound-shell/src/hotkey.rs.
• Rust (chore: bump the rust group with 6 updates #80): interprocess 2.4.7, serde_json 1.0.154, psl 2.1.245, libc 0.2.191, objc2 0.6.5, tauri-winres 0.3.7. These are the same versions Dependabot proposed, pinned with cargo update --precise.
• Actions (chore: bump the actions group with 6 updates #79): rust-cache, setup-node, install-action, upload-artifact, download-artifact and setup-uv, each pinned to its new SHA.
• Picker npm (chore: bump the picker group in /app with 8 updates #78): react / react-dom 19.3.1, Biome 2.6.3, Stryker 10.1.1, user-event 14.6.8, plugin-react 6.1.2, jsdom 30.1.3.
• Tooling npm (chore: bump js-yaml from 5.4.3 to 5.5.0 #77): js-yaml 5.5.0.
• Notices: regenerated THIRD-PARTY-BUNDLED.md and THIRD-PARTY-LICENSES.md with npm run notices, so the rules check matches the lockfiles.

Added on top

• minimatch override (^11.0.4), scoped to @stryker-mutator/core. Stryker pins minimatch 10, which is hit by GHSA-g3hv-75wg-m249 (moderate). The npm audit step for the picker would fail on main too. This follows the existing scoped qs override.
• app/biome.json migrated with biome migrate. The schema moves to 2.6.3, and "recommended": true becomes "preset": "recommended". Without this, Biome 2.6 warns that the schema doesn't match.

Checked locally (Windows)

• cargo clippy --workspace --all-targets: no warnings.
• cargo check -p passes for each crate on its own.
• cargo nextest: 457 passed.
• cargo fmt --check: clean.
• Picker: npm run lint, npm run build, 203 vitest tests.
• npm audit --audit-level=moderate is clean in app and at the root.
• npm run lint:md is clean.
• npm run notices leaves no diff.

For the reviewer

• The global shortcut was not tried by hand. global-hotkey is a major bump, so it's worth one manual press to see it still opens the picker.
• stryker run --dryRunOnly fails locally, the same way on main. src/markdown.test.ts imports ../../THIRD-PARTY-*.md, which sits outside Stryker's sandbox. It happens with minimatch 10 as well, so this branch doesn't cause it. This PR doesn't touch app/src, so the mutants job won't run it here.

Supersedes #77, #78, #79, #80 and #81. Dependabot closes them on its own once these versions are on main.