Version sync: leave the vendored sevenz-rust2 at its own version

The sync treats every lockfile crate without a source as ours and set
the vendored sevenz-rust2 to the app version (7.0.5, 7.0.6), the same
trap unrar fell into; cargo then wrote 0.23.0 back and CI's version
check failed. It joins unrar on the vendored list, and the desktop
lockfile is back to 0.23.0. Builds were unaffected: cargo always built
the vendored source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9

client/src-tauri/Cargo.lock

@@ -5155,7 +5155,7 @@ dependencies = [
 
 [[package]]
 name = "sevenz-rust2"
-version = "7.0.6"
+version = "0.23.0"
 dependencies = [
  "crc32fast",
  "js-sys",

scripts/update-version.js

@@ -136,7 +136,7 @@ function patchRegex(relPath, regex, replacer, extractor) {
 // gets them "synced" to the ps5upload version — renaming unrar 0.5.8 to
 // 5.3.1 and drifting the lockfile on every release. They keep upstream's
 // version; only their vendored copy's own Cargo.toml governs it.
-const VENDORED_THIRD_PARTY = new Set(["unrar"]);
+const VENDORED_THIRD_PARTY = new Set(["unrar", "sevenz-rust2"]);
 
 function patchCargoLock(relPath) {
   const full = path.join(repoRoot, relPath);