CVE-2025-14282: dropbear -> 2025.89

[jasonodoom]

Evidence: CVE-2025-14282 (auto-merge) trace bundle 6109742966258304

• Rekor entry: https://rekor.sigstore.dev/api/v1/log/entries?logIndex=1769675684
• Workflow identity: https://github.com/Ad-Astra-Computing/trace/.github/workflows/steward.yml@refs/heads/main
• OIDC issuer: https://token.actions.githubusercontent.com
• Cert run: https://github.com/Ad-Astra-Computing/trace/actions/runs/27230873481
• nixpkgs rev: 68f48a6295d7c9e1086b6122f255194874bd0c83

Verify locally

gh run download <run-id> --name steward-smoke-<bundle> --dir ./artifact
trace bundle verify ./artifact  # bundle_id=6109742966258304

Generated by trace.