Dependency notices for plug-in exports and standalone applications

Opt-in review¶

The export surface links 20 third-party crates, all pure Rust with no C build step.

• ravet-webview (Cocoa and WebKit, plus a compiled Objective-C++ archive on macOS) is now behind the ravet-plugin editor feature (umbrella plugin-editor). clap and native alone build no editor.
• sha2 and its RustCrypto helpers derive the VST3 and AAX identities at run time, so they stay required.
• serde_json is part of the editor protocol and of the PluginExport::editor_message signature, so it stays required in 0.1.0.

The unified macOS bundler resolves notices for the explicit Rust target selected by --arch. Universal builds include the union of normal dependencies from aarch64-apple-darwin and x86_64-apple-darwin, replacing any host-only notice written by an adapter before final signing. See bundle architecture selection.