Track unresolved quick-xml RustSec advisories in document parsing stack

[matthewod11-stack]

Context

The 2026-07 RustSec advisory refresh introduced quick-xml parser DoS advisories:

• RUSTSEC-2026-0194
• RUSTSEC-2026-0195

PR #133 reduced what we can fix directly today by moving document parser dependencies forward:

• pdf-extract 0.10 -> 0.12, clearing the fixed lopdf advisory path
• calamine 0.26 -> 0.35, moving spreadsheet parsing to the current upstream line

Remaining debt

cargo audit still needs temporary ignores for RUSTSEC-2026-0194 and RUSTSEC-2026-0195 because current upstream dependency lines still pull vulnerable quick-xml versions:

• quick-xml@0.36.2 via docx-rs@0.4.20
• quick-xml@0.39.4 via current calamine / Tauri plist

Acceptance criteria

• Re-check whether calamine, docx-rs, plist, or Tauri expose quick-xml >= 0.41
• Prefer dependency upgrades over ignores
• If docx-rs remains stale, consider replacing DOCX parsing with a small ZIP + XML extractor owned in-repo
• Remove the RUSTSEC-2026-0194 / RUSTSEC-2026-0195 ignores from .github/workflows/security.yml
• cargo audit --ignore RUSTSEC-2023-0071 passes without the quick-xml ignores

[matthewod11-stack]

Orchestrator (2026-07-18): skipped — no Automation Hints block, and this is dependency-upgrade work.

Two independent reasons this can't be picked up automatically:

1. The issue has no ## Automation Hints section — no scope, approach, risk, or max-files-changed. Orchestrator policy is to skip rather than infer them.
2. The acceptance criteria are led by "Prefer dependency upgrades over ignores". Dependency changes are explicitly human-review-only for this agent (never installs/upgrades deps).

Factual check against src-tauri/Cargo.lock as of tonight (read-only), answering acceptance criterion 1 — "Re-check whether calamine, docx-rs, plist, or Tauri expose quick-xml >= 0.41":

Parent	quick-xml pulled	>= 0.41?
calamine	0.39.4	no
docx-rs	0.36.2	no
plist	0.38.4	no

Answer: no — none of the three expose quick-xml >= 0.41 yet, so the RUSTSEC-2026-0194/0195 ignores in .github/workflows/security.yml (lines 63-64) still cannot be removed. This issue is correctly still open; it's blocked on upstream, not on effort.

One small correction to the issue body: it lists quick-xml@0.39.4 via current calamine / Tauri plist, but plist actually pulls a third distinct version, 0.38.4 — so there are three vulnerable versions in the tree, not two.

Suggest adding a hints block scoped to the ignore-removal step alone (scope: .github/workflows/security.yml, approach: config-change, risk: low) so that once upstream lands 0.41+, the cleanup half can be picked up automatically — while the dependency bumps stay a human decision.