chore(deps): unblock dev CI — ignore RUSTSEC-2026-0247, patch russh/quinn-proto, resync Cargo.lock

[gnanirahulnutakki]

Three coupled fixes that together restore a mergeable dev.

1. cargo-deny (required check) is failing on every open PR and on dev
   itself with a single finding:

   error[unmaintained]: bitmaps is unmaintained
     ID: RUSTSEC-2026-0247
     Solution: No safe upgrade is available!
   

   bitmaps is transitive only, via matrix-sdk -> imbl ->
   imbl-sized-chunks. It is an unmaintained notice, not a vulnerability,
   and cargo-deny itself reports that no safe upgrade exists. That is
   exactly the class [advisories].ignore already documents (bincode via
   syntect, paste via fastembed, proc-macro-error2 via Matrix/Teloxide,
   rustls-pemfile via qdrant-client), so it is ignored on the same terms.
   Vulnerability advisories are still upgraded rather than ignored — see
   (2).

2. Patch the two crates behind all five open Dependabot alerts. Both are
   reachable from the workspace and both have released fixes:

   • russh 0.62.2 -> 0.62.5 (direct dep of crates/terminal), closing
     GHSA-m65r-rprj-r5rg (CVE-2026-68930, channel-scoped server
     callbacks reachable without an open channel), GHSA-g9hv-x236-4qp3
     (pre-auth X25519 wrong-length panic), GHSA-cqjc-rmpq-xprq
     (post-auth pty-req panic) and GHSA-5xvq-cp9x-6p6r (pre-auth
     all-zero Curve25519 encode_mpint OOB).
   • quinn-proto 0.11.14 -> 0.11.16 (transitive), closing the one HIGH
     alert, GHSA-4w2j-m93h-cj5j (remote memory exhaustion from
     unbounded out-of-order stream reassembly).

   Dependabot did raise these as chore(deps): Bump russh from 0.62.1 to 0.62.5 #385 and chore(deps): Bump quinn-proto from 0.11.14 to 0.11.16 #382, but against main, where
   they fail DCO; dev never received them.

3. Resync Cargo.lock, which had drifted from the manifests: it was
   missing ardur-delegate-tool (feat(§5.1): delegate_task tool over the ardur-multi-agent substrate #332) and ardur-durability (feat(durability): atomic writes, backup/restore, and schema versioning for durable state #327)
   along with tar/filetime/xattr, and still carried stale entries.
   .github/workflows/release.yml builds --locked, so a release cut
   from dev would have failed to resolve. cargo metadata --locked now
   succeeds.

Verified locally: cargo deny check reports advisories/bans/licenses/
sources all ok; cargo fmt --check, cargo build --workspace and
cargo clippy --workspace --all-targets -D warnings are clean.

---

Why this lands first: cargo-deny is a required check and is currently red on every open PR (#368, #369, #370, #372, #373, #374, #375 all show exactly one failing required check, and it is this one). Nothing can merge into dev until the advisory is resolved.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 09122de7-065c-415c-8a6b-c8b572b48191

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}