[BryanFRD]

Lockfile-only bump:

• rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382)
• webpki-roots 1.0.9 -> 1.0.11 (RUSTSEC-2026-0381)
• webpki-root-certs 1.0.9 -> 1.0.11 (RUSTSEC-2026-0383)
• ctutils 0.4.2 -> 0.4.7 (RUSTSEC-2026-0385)
• yoke-derive 0.8.3 -> 0.8.4 (yanked)

Still reported by cargo audit, not fixable here: crypto-bigint 0.5.5 (RUSTSEC-2026-0387, pinned by elliptic-curve 0.13 via jsonwebtoken) and rsa 0.9.10 (RUSTSEC-2023-0071, no fix upstream).

fmt and clippy clean. Tests pass except gc::tests::preparing_fetches_new_branches_tags_and_review_refs, which fails locally on git tag ("no tag message") due to my git config, unrelated to this change.

Closes #692

[ferrfleet-interne]

Ready to merge. Lockfile-only patch bumps, nothing blocking. Windows CI should be green first (see the suggestion below).

What changed (Cargo.lock only)

• rustls-webpki 0.103.15 -> 0.103.16
• webpki-roots and webpki-root-certs 1.0.9 -> 1.0.11
• ctutils 0.4.2 -> 0.4.7
• yoke-derive 0.8.3 -> 0.8.4

These stay on the same crate lines, checksums are present, and the ring provider is unchanged.

Suggestion

• Cargo.lock:639 (also the other windows-sys hunks): errno, rustix, rustls-platform-verifier, tempfile and winapi-util moved from windows-sys 0.52.0 to 0.61.2. This comes from the resolver, not from the advisories named in the title. It is harmless: 0.61 needs Rust 1.71 and the workspace MSRV is 1.88, and the 0.52.0 entry stays in the lock for other dependents. Mention it in the PR description so reviewers know it was expected, or use cargo update -p <crate> --precise <ver> per crate if you want a narrower diff.

Formal verification

Property	Result
None	Nothing to prove

No first-party code changed, so there was nothing to write proofs against. Verifying upstream crates such as rustls-webpki path validation is out of scope for this PR.