fix(deps): bump tray Cargo.lock past 3 Dependabot alerts

Resolves the 3 low-severity Dependabot alerts that have been pinging on
every push to boj-server. All three landed in tray/Cargo.lock:

- rustls-webpki 0.103.10 → 0.103.12
    - GHSA for wildcard-name handling under certificate name constraints.
    - GHSA for URI name handling under certificate name constraints.
- rand 0.9.2 → 0.9.4
    - Unsound interaction between rand::rng() and a custom logger.

Both are patch bumps. `cargo check` passes clean from the updated lock.
The bumps are lock-only — Cargo.toml dependency ranges already accepted
these versions, so no manifest edit was needed.

Also records the fact in .machine_readable/6a2/STATE.a2ml so the
dependabot-alerts = 0 counter is no longer a stale claim — it now
reflects a verified zero as of 2026-04-18.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -70,7 +70,7 @@ cartridge-shared-libs-on-disk = 0       # nothing pre-built is committed — the
 safety-modules = 7  # Safety, Guardian, SafeHTTP, SafePromptInjection, SafeCORS, SafeAPIKey, SafeWebSocket
 sse-transport = true  # Port 7703 — fixed 2026-03-29
 glama-grade = "AAA"  # Security A, License A, Quality A
-dependabot-alerts = 0
+dependabot-alerts = 0  # 3 low-sev alerts (rustls-webpki x2, rand) resolved 2026-04-18 via tray/Cargo.lock patch bumps; cargo check clean
 benchmark = true  # 63 V-lang ecosystem benchmarks + 10 MCP baselines
 ci-pipeline = "zig-test.yml"
 topology = true