fix(deps): unwedge the security gates — yanked crates + two live advisories

[CueCrux-Myles]

What

main has had no merge since 2026-08-26 and all 17 open PRs are blocked. The cause is not any one PR: Cargo deny policy and Cargo audit read an advisory database that updates daily, so a lockfile that was green when it merged goes red on its own. Twelve dependabot PRs (#771–#784) fail on this, and seven of them fail on nothing else.

This is lockfile-only. All five bumps are semver-compatible; no manifest requirement changes.

Crate	From → To	Why
chacha20	0.10.0 → 0.10.2	yanked (0.10.1 also yanked) — via chacha20poly1305 from corecrux-receipts, corecrux-secrets, crux-escrow
der	0.8.0 → 0.8.2	yanked — via x509-cert 0.3.0
wnaf	0.14.0 → 0.14.1	yanked — via primeorder → p256
rustls	0.23.40 → 0.23.45	RUSTSEC-2026-0285 — TLS 1.3 handshake messages accepted at the wrong encryption level after a key change in the same record. Patched >= 0.23.45. Via ureq from rcx-revocation
wasmtime	47.0.3 → 47.0.4	RUSTSEC-2026-0269 (filesystem sandbox escape on trailing slashes) + RUSTSEC-2026-0268 (guest-controlled host heap allocation via WASIp3 streams). Both patched >= 47.0.4

Why wasmtime stays on the 47 line

crates/corecruxd/Cargo.toml declares wasmtime = "47", so 47.0.4 clears both advisories without touching the requirement. Dependabot #778 proposes the 48 major bump — that is a real API-surface review and should not ride along with an unwedging change.

The (requires Rust 1.94.0) note cargo prints on this update is not an MSRV problem: 47.0.3 already declared rust-version = 1.94.0, the workspace is resolver = "2", and wasm-extensions is off by default, so the MSRV (1.88.0) job never builds wasmtime.

Verification

Run locally against the current advisory DB (cargo-deny 0.19.9):

cargo deny check                       -> advisories ok, bans ok, licenses ok, sources ok (exit 0)
cargo check --workspace --all-targets  -> exit 0, no new warnings

⚠️ This does not unblock CI on its own

runner-hel1 has /srv/data at 92% full. That trips the daemon's data_dir_capacity readyz check:

readyz=503 {"name":"data_dir_capacity","ok":false,
 "error":"data dir free ratio below emergency threshold
          (free_ratio=0.080 threshold=0.100 free_bytes=74224787456 total_bytes=923754631168)"}

Every integration test that waits on health then fails with a bare not healthy in 10s — 46 of them on PR #781. Test and Coverage will keep failing until someone prunes the runner. That is an ops fix, not a code change, and it needs to happen before this merges.

Follow-on order

1. This PR (needs the runner disk freed first).
2. proof-carrying-adaptive-packs-2026-07-13 M1: Shadow-corpus staging + replay harness #769 — adaptive-packs M1 install gate. Green, but its checks ran 2026-08-26, before the advisory DB caught up; it will go red in the merge queue until this lands.
3. Drain chore(deps): bump syn from 3.0.3 to 3.0.5 #771–chore(deps): bump wasmtime from 47.0.4 to 48.0.2 #778, which should then pass on their own.
4. Review chore(deps): bump wasmtime from 47.0.4 to 48.0.2 #778 (wasmtime 48) and chore(deps): bump tree-sitter from 0.26.12 to 0.27.0 #783 (tree-sitter 0.27) as real major bumps.

🤖 Generated with Claude Code