deps: refresh bump-safe batch

Manifest pin widening:
- clap 4.5 -> 4.6 (env-var rebuild correctness, derive hygiene)
- tun 0.8.5 -> 0.8.7 (Linux ioctl-type fix)

Lockfile-only refreshes within existing pins:
- tokio -> 1.52.3
- tracing-subscriber -> 0.3.23
- socket2 -> 0.6.3
- futures -> 0.3.32
- libc -> 0.2.186
- tempfile -> 3.27.0
- bytes (transitive) -> 1.11.1+ (clears RUSTSEC-2026-0007 BytesMut::reserve overflow)

All additive; no source-level migration required.

Cargo.toml

@@ -22,7 +22,7 @@ serde_json = "1.0"
 serde_yaml = "0.9"
 dirs = "6.0"
 hex = "0.4"
-clap = { version = "4.5", features = ["derive"] }
+clap = { version = "4.6", features = ["derive"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tokio = { version = "1", features = ["rt", "macros", "signal", "sync", "net", "time", "process", "io-util"] }
@@ -36,7 +36,7 @@ nostr = { version = "0.44", features = ["std", "nip59"] }
 nostr-sdk = "0.44"
 
 [target.'cfg(unix)'.dependencies]
-tun = { version = "0.8.5", features = ["async"] }
+tun = { version = "0.8.7", features = ["async"] }
 libc = "0.2"
 
 [target.'cfg(target_os = "linux")'.dependencies]