chore(vendor): bump nested tinybus to e5f1cd2d2

[M3gA-Mind]

Summary

Moves the nested vendor/tinybus gitlink from 3aba4abe8 to tinybus main e5f1cd2d2, so this repo builds and tests against current tinybus (0.1.2). Only the gitlink and the lockfile entries it requires change; no source change.

Related issue

Refs tinyhumansai/openhuman#6750 (update nested submodule pins inside each vendor repo).

API or behavior changes

None in this repo's API. Upstream tinybus changes picked up:

Range 3aba4abe8..e5f1cd2d2 (tinybus main, 25 commits):

• release tinybus 0.1.2;
• statically linked module entrypoints: multiple linked entries, init without shared global hooks, admission validated before activation, isolated manifest caches;
• Windows module-loading hardening: artifact ownership/ACL verification, CREATOR OWNER and current-process SID trust, dependency lookup limited to trusted directories;
• ea441c6 "keep dynamic module exports explicit": the module_export! public syntax is unchanged, but it removes the static-link cargo feature. That feature was introduced inside this same range, and this repo does not use it, so no source change is needed.

Lockfile. Cargo.lock moves only tinybus, tinybus-macros and tinybus-module 0.1.1 → 0.1.2 (+3/−3). No other package version or dependency list changes (audited per package). cargo update was not run.

Validation

Commands actually run (local macOS, RUST_MIN_STACK=67108864), with their outcome:

• cargo fmt --all -- --check: exit 0
• cargo clippy --all-targets --all-features -- -D warnings: see the toolchain note below; clean with -A unknown-lints added (exit 0, 0 diagnostics)
• cargo build --all-targets --all-features: not run separately (clippy --all-targets and cargo test compiled every target)
• cargo test --all-features: exit 0, 123 passed, 0 failed
• .github/scripts/check-file-coverage.sh 90 coverage.json: not run locally; CI runs it

Toolchain note (not caused by this PR). Locally, clippy exits 101 on one error: unknown lint: clippy::unused_async_trait_impl in this repo's own #[allow(...)] (crates/tinydocs-module/src/service/mod.rs).

• The local toolchain is stable 1.97.0 (2026-07-07), which predates that lint. This repo pins no toolchain and CI uses dtolnay/rust-toolchain@stable.
• Upstream main CI's Clippy step passes.
• Control: the same local clippy on unbumped upstream main fails identically.
• With only -A unknown-lints added (everything else still -D warnings), clippy is clean.

This PR's own CI Clippy run is the authoritative gate.

Tests

None added: dependency pin update only. The existing suite passes against the new tinybus.

Documentation

Not needed: no API or usage change in this repo.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9d4067a5-7e05-4653-8526-a30dcbade22c

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below.

State: Ready for maintainer review
Priority: none
Reviewed head: 8be0ae79828a
Updated: 1790612959 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

security

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No added or modified lines to review.

Evidence and run details

• Models: ladder/vectors
• Spend: $0.000000
• Tokens: 0 input · 0 output · 0 cached · 24 embedding

Head	State	Pass summary
8be0ae79828a	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 1790612959)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 24 embedded · ladder/vectors

[M3gA-Mind]

Audit (no blocking findings) for tinyhumansai/openhuman#6750

• Gitlinks: only vendor/tinybus moves, 3aba4abe → e5f1cd2d. That is tinybus main HEAD, a fast-forward that includes the ea441c6 export-macro change.
• Module ABI: unchanged. ABI_REVISION = 1 and the TBUSMOD v1 magic are the same at both pins.
• Lockfile: the tinybus workspace version goes from 0.1.1 to 0.1.2, and Cargo.lock moves exactly tinybus, tinybus-macros and tinybus-module from 0.1.1 to 0.1.2, as required.
• Code: none changed.
• CI: every check green or skipped.