Drop two dependencies nothing was using

The first thing CI caught, on its first run, in the commit that added it.

`runway-caldav` depended on serde and never mentioned it. `runway-cli`
depended on tracing while using tracing-subscriber, which is a different
crate; the subscriber stays.

I had run `cargo machete` before committing the workflow and reported it
clean. It was not: the tool prints a paragraph of advice about ignoring false
positives *when it finds something*, and I had tailed the output, seen that
paragraph and "Done!", and cut the two findings off the top. So the check I
claimed to have made was the one thing I had not made.

Which is a decent argument for the guardrail existing. v1 shipped reqwest,
ical, regex and indexed_db_futures into a WASM bundle that used none of them,
and it shipped them because nobody was looking -- not because looking was hard.

Cargo.lock

@@ -2366,7 +2366,6 @@ dependencies = [
  "quick-xml",
  "reqwest",
  "runway-core",
- "serde",
  "thiserror 2.0.20",
  "tokio",
  "tracing",
@@ -2383,7 +2382,6 @@ dependencies = [
  "runway-caldav",
  "runway-core",
  "tokio",
- "tracing",
  "tracing-subscriber",
 ]
 

crates/runway-caldav/Cargo.toml

@@ -10,7 +10,6 @@ runway-core = { workspace = true, features = ["ical"] }
 chrono = { workspace = true }
 quick-xml = { workspace = true }
 reqwest = { workspace = true }
-serde = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }
 

crates/runway-cli/Cargo.toml

@@ -13,7 +13,6 @@ chrono-tz = { workspace = true }
 clap = { workspace = true }
 iana-time-zone = { workspace = true }
 tokio = { workspace = true }
-tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 
 [lints]