[brynary]

Responds to the eMudhra intermediate CA compromise. Locked builds now use rustls-webpki 0.103.16 to reject the compromised intermediate keys and webpki roots/root-certs 1.0.10 where present.

The enabled PostgreSQL TLS path uses sqlx → rustls. Updates cover the root, warehouse consumer, and both checked-in validation lockfiles. The archival conveyor-adoption probe uses missing absolute /tmp paths; its package records were taken from the regenerated root lock.

Validation:

• Dependency lock audit, enabled feature-tree inspection, all-target/all-feature check, the configured bin/test +1.97.1 PostgreSQL/SQLite/no-backend matrix, both warehouse consumer tests, Clippy with warnings denied, and pinned formatting all passed. The database tests used a disposable local PostgreSQL container. A temporary workspace boundary was removed after verification and is not in this PR. The archival conveyor-adoption probe cannot run without its missing absolute-path source dependencies. GitHub CI is pending.
• A shared deterministic probe using rustls-webpki 0.103.16 rejected all 12 advisory chains with CertDistrusted while retaining the original roots, and accepted a generated valid control chain. This verifies the upstream mitigation; it does not replace application build/runtime checks.
• No advisory-specific Dependabot alert is being claimed closed. The API returned no open alerts, or alerts are disabled for this repository.

After merge, rebuild and publish affected artifacts and update consumers/deployments. Existing binaries are not repaired by this lockfile change. Bun runtime updates remain deferred until a fixed stable release.

Upstream fixes: webpki 0.103.16, root bundles 1.0.10.