perf(deps): reqwest→ureq drops async stack + cleanup (v3.2.18)

[kengio]

What

Five dependency/cleanup changes for the v3.3 cycle, bundled as one patch release (3.2.17 → 3.2.18). No new CLI command — the planned completions command is deliberately deferred to ship with the daemon in v3.3, so the 3.3.0 slot stays reserved for the daemon.

Changes

• reqwest → ureq (blocking sync HTTP) across the 4 GitHub/tarball fetch sites (update, vault-sync). ureq has no async runtime, so this removes the entire async stack — tokio · hyper · h2 · tower · tower-http · hyper-rustls · tokio-rustls · hyper-util — from the release binary (all were pulled in only by reqwest). TLS stays rustls (ureq default features); JSON is parsed via the existing serde_json (ureq's json feature left off). ureq's http_status_as_error default maps 4xx/5xx → Err(StatusCode), replacing the old .status().is_success() checks with equivalent error arms.
• Removed the dead tokio_helper runtime shim (#[allow(dead_code)], zero callers, the only direct tokio user). It was reserved for "future async commands (v3.1+ serve)" — i.e. the daemon, which is the next milestone (v3.3) and will re-introduce tokio deliberately for its async RPC server. ⚠️ Reviewer note: this deletes code reserved for the next milestone; both review passes endorsed it (removing it is what lets the async stack actually leave the binary; re-adding a 16-line block_on helper in v3.3 is trivial and git history preserves it).
• serde_yaml (archived/unmaintained) → serde_yaml_ng via a package-rename alias — actively-maintained drop-in, zero code changes.
• Dropped the unused clap env feature (no #[arg(env)] anywhere).
• Unified the two plugin update text renderers into one render_plugin_update_inner<W>, removing the PluginUpdateTextData trait that existed only to make the static renderer generic over a test double (−~80 LOC; Code-Simplifier finding on PR feat(cli): 3 UX fixes — compact --help, silent plugin update sub-output, --json minified (v3.2.15) #57).
• Renamed vault_sync::run_silent + register_schedule::run_quiet → both run_embedded — same intent (the embedded-from-plugin-update entry point), consistent name (Consistency reviewer finding on PR feat(cli): 3 UX fixes — compact --help, silent plugin update sub-output, --json minified (v3.2.15) #57).

Measured impact (release binary, opt-level=z + lto=fat + strip)

metric	before (3.2.17)	after (3.2.18)	delta
binary size	3.34 MB (3,502,288 B)	3.01 MB (3,152,400 B)	−342 KB (−10%)
normal deps	178	124	−54
clean release build	41.0 s	36.2 s	−4.9 s (~12%)
async stack in release tree	tokio/hyper/h2/tower/reqwest	none	✓ gone
session init warm runtime	6.06 ms	5.65 ms	~unchanged (noise)

Honest note: an earlier rough estimate put the binary saving at −700–900 KB. Actual is −342 KB — the binary already ran opt-level="z" + lto="fat" + strip, so LTO had already dead-stripped much of the unused async code before this change. The dependency-count, compile-time, and maintenance wins are the larger payoff; runtime is unchanged (the everyday commands never made HTTP calls).

Verification

• cargo fmt --check clean · cargo clippy --workspace --all-targets -- -D warnings clean (0 warnings)
• cargo test --workspace — 1296 passed / 1 ignored / 0 failed (unchanged from baseline; mockito-backed update/vault-sync integration tests exercise the real ureq path incl. 200 + non-2xx → error mapping)
• Live onebrain update --check verified against real GitHub over rustls
• 3-round review (correctness/ureq parity · deps+tokio-removal safety · holistic): no material code issues; the one finding (stale docs/reference/ mentioning reqwest/tokio) was fixed in this PR

Version: patch 3.2.17 → 3.2.18 (dependency/cleanup release, no new first-level command).

🤖 Generated with Claude Code