build(deps): bump sqlx 0.9, windows-sys 0.61, and 3 GitHub Actions (#18)

Bundles the open Dependabot PRs into one change:

- sqlx 0.8.6 -> 0.9.0 (#8): wrap the dynamic table_row_count query string
  in sqlx::AssertSqlSafe to satisfy 0.9's SqlSafeStr requirement (the name
  is allow-listed from KNOWN_STATE_TABLES, no caller substring), and
  regenerate the .sqlx offline cache (0.9 records a new per-column origin
  field).
- windows-sys 0.59 -> 0.61.2 (#10): FILE_RENAME_INFO.ReplaceIfExists is
  now a Rust bool, so set it to true instead of 1.
- googleapis/release-please-action v4 -> v5 (#2)
- softprops/action-gh-release v2 -> v3 (#3)
- cloudflare/wrangler-action v3 -> v4 (#5)

Verified locally on Windows: cargo fmt --check, clippy --all-targets
-D warnings, SQLX_OFFLINE cargo check --all-targets, and driven-core
tests all pass.


Claude-Session: https://claude.ai/code/session_0137BoWLRRPzC9XqA14KHyFU

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: pmaxhogan

.github/workflows/deploy-landing.yml

@@ -76,7 +76,7 @@ jobs:
 
       # 3. Deploy the whole site (landing + both channels' updates) to CF Pages.
       - name: Deploy site to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/dev-channel.yml

@@ -260,7 +260,7 @@ jobs:
           echo "Collected:"; ls -la "$out" || true
 
       - name: Publish to rolling dev pre-release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: dev
           name: "Driven dev (rolling)"
@@ -419,7 +419,7 @@ jobs:
       # bare `updates/` dir, so the served path keeps the `/updates/` prefix and
       # matches the app's `updates/dev/<os>/<arch>/update.json` fetch endpoint.
       - name: Deploy dev manifests to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.github/workflows/release-please.yml

@@ -22,7 +22,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         with:
           # Prefer a PAT / App token (RELEASE_PLEASE_TOKEN) so the release PR is
           # authored by a real identity and its CI runs WITHOUT the manual

.github/workflows/release.yml

@@ -290,7 +290,7 @@ jobs:
       # matches the app's fetch endpoint. Deploying `updates` made its contents the
       # Pages root (`/stable/...`), 404ing every updater check.
       - name: Deploy manifests to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}