[Marc-André Moreau (mamoreau-devolutions)]

• I have read the contributing guidelines, and I agree with the Code of Conduct.
• Have you checked that there aren't other open pull requests for the same changes?
• Have you tested that the committed code can be executed without errors?
• Have you confirmed that this issue is caused by UniGetUI itself, and not by the package manager or the package involved?
  If the same issue can be reproduced outside UniGetUI with the relevant package manager or with the package itself, please report it there first. UniGetUI should only be used to track issues that are specific to UniGetUI's behavior or integration.

---

Summary

Remove cargo-binstall and cargo-update as requirements for UniGetUI's local Cargo integration. Existing installations of those tools remain ordinary packages and are not removed.

• Enumerate installed packages with built-in Cargo and detect newer stable, non-yanked crates.io versions in C#, with API pacing, caching, and source provenance.
• Install verified publisher-provided binaries through a NativeAOT-safe C# resolver, bounded downloader/extractor, and transactional Cargo-compatible installation tracking. No cargo-quickinstall or other third-party binary host is used.
• Fall back to ordinary Cargo source compilation for the exact selected version when a compatible verified binary is unavailable. Integrity failures and unsafe archives remain failures rather than fallback triggers.
• Preserve Cargo list/uninstall interoperability, tracking-file locks, multi-binary rollback/recovery, cancellation, operation serialization, and broker precedence. Recovery refuses to overwrite later external Cargo changes.
• Keep Git/path/private-registry packages isolated from unrelated same-name crates.io metadata, version catalogs, and source downloads.
• Remove dependency prompts, helper detection/invocations, and binstall-specific retry state; update command previews, documentation, attribution, and managed TOML license distribution.

Validation

Command	Result
dotnet test src\UniGetUI.PackageEngine.Tests\UniGetUI.PackageEngine.Tests.csproj --filter FullyQualifiedName~Cargo --verbosity q --nologo /p:Platform=x64	Passed: 212 cases on each of the portable and Windows TFMs; 424 executions, zero failures/skips. Includes separate-process Cargo lock contention and real Cargo list/uninstall interoperability.
dotnet test src\UniGetUI.Core.Tools.Tests\UniGetUI.Core.Tools.Tests.csproj --framework net10.0 --no-build --no-restore --filter FullyQualifiedName~MetaTests --verbosity q --nologo /p:Platform=x64	Passed: all 4 source-policy tests.
dotnet format whitespace src --folder --verbosity quiet	Passed.
dotnet format style src\UniGetUI.Windows.slnx --no-restore --verbosity quiet	Passed.
dotnet format whitespace src --folder --verify-no-changes --verbosity minimal	Passed.
dotnet format style src\UniGetUI.Windows.slnx --no-restore --verify-no-changes --verbosity minimal	Passed.
dotnet publish scripts\CargoSmoke\CargoSmoke.csproj --configuration Release --runtime win-x64 --self-contained true /p:Platform=x64 --verbosity quiet --nologo	Passed: reflection disabled, trim/AOT warnings treated as errors.
.\scripts\CargoSmoke\bin\x64\Release\net10.0\win-x64\publish\UniGetUI.Cargo.Smoke.exe	Passed: native resolver, TOML/JSON, checksums, extraction, tracking, real Cargo listing, an offline Cargo source-build upgrade, and uninstallation in an isolated root.
dotnet publish src\UniGetUI.Avalonia\UniGetUI.Avalonia.csproj --configuration Release --runtime win-x64 --self-contained true /p:Platform=x64 /p:PublishProfile=Win-x64-NativeAot --verbosity quiet --nologo	Passed: zero Cargo trim/AOT warnings. The app still reports 16 warnings from existing third-party dependencies.
dotnet test src\UniGetUI.Windows.slnx --verbosity q --nologo /p:Platform=x64 /p:TestTfmsInParallel=false	Not clean: package-engine, app, and TUI suites passed; 3 cases in unchanged SecureSettingsTests.ApplyForUser_RefusesComponentsThatEscapeTheSecureSettingsRoot failed while comparing the shared temporary parent's entry count. No unrelated settings/test changes are included.
dotnet test src\UniGetUI.Core.Settings.Tests\UniGetUI.Core.Settings.Tests.csproj --framework net10.0 --no-build --no-restore --verbosity q --nologo /p:Platform=x64 /p:TestTfmsInParallel=false -m:1	Passed: the complete settings suite passes 97/97 in isolation.

Compatibility and remaining verification gaps

• Custom installation locations now have Cargo install-root semantics: executables are installed under <root>\bin. Review saved locations that previously used binstall's direct --install-path semantics.
• Supported managed binary formats are ZIP, TAR, TAR.GZ/TGZ, and explicitly configured raw executables. A supported publisher checksum is required; unsupported signing metadata selects source compilation.
• Standalone/exported commands, custom build settings, and elevated execution use ordinary Cargo source commands. Broker-owned operations remain delegated to the external Agent and never fall back to a local installer after denial/unavailability.
• Windows x64 native execution is verified. Linux/macOS/arm64 native runtime locking/permissions and the external Agent's own Cargo execution prerequisites remain unverified, not passing claims.
• The first template checkbox is left for the submitting user's personal confirmation; the contribution guidelines and code of conduct were inspected while preparing this PR.

---

Closes: N/A — no linked issue.

Relates to: N/A.