fix: repair release validation and update desktop Rust

[tulayha]

Summary

• grant the reusable CI workflow its declared pull-requests: read permission from both prerelease and stable-release callers
• build the desktop with the current stable Rust channel and declare Rust 1.88 as the minimum supported compiler
• align direct Tauri plugin versions with the current resolved releases
• update time to 0.3.47 and serde_with to 3.21.0, clearing the two resolvable Cargo advisories
• add a desktop-local stable Rust toolchain selection

Root cause

The merged prerelease caller only granted contents: read, while the reusable CI workflow also requests pull-requests: read, so GitHub rejected the workflow before any job could start. Separately, the desktop was pinned to Rust 1.85; Cargo therefore held time and serde_with below their first patched releases because those releases require Rust 1.88.

Validation

• cargo +1.97.1 test --release --locked --manifest-path desktop/src-tauri/Cargo.toml — 8 passed
• cargo +1.97.1 metadata --locked --no-deps --manifest-path desktop/src-tauri/Cargo.toml --format-version 1
• actionlint .github/workflows/*.yml

Remaining upstream issues

This does not conceal the two alerts that cannot currently be repaired with a dependency update: Tauri 2.11.5 still uses the GLib 0.18 binding line, while the advisory is fixed in GLib 0.20; ChromaDB's critical advisory currently has no patched release.