CVE-2023-4863: libwebp, backport upstream fix (no version bump)

[jasonodoom]

⚠️ EXPERIMENTAL source-backport — NOT a version bump

This PR authors the upstream fix as an in-tree patch against the current nixpkgs version (no version bump). An agent generated it; a cross-family reviewer verified it transcribes the upstream commit, and a cert proved the bundled reproducer goes red→green. A human maintainer must still confirm sufficiency before merging:

• This applies the COMPLETE upstream fix, not one of several required commits.
• The backported hunk matches the upstream fix commit(s):
  • webmproject/libwebp@2af2626
• Reviewed the cert evidence (reproducer red→green) for CVE-2023-4863.

Opened as a draft deliberately — mark Ready-for-review only after the boxes above are checked.

---

Evidence: CVE-2023-4863 (human-review-required) trace bundle d23c4c84ab95858e

• Rekor entry: https://rekor.sigstore.dev/api/v1/log/entries?logIndex=2727407066
• Workflow identity: https://github.com/Ad-Astra-Computing/trace/.github/workflows/steward.yml@refs/heads/main
• OIDC issuer: https://token.actions.githubusercontent.com
• Cert run: https://github.com/Ad-Astra-Computing/trace/actions/runs/33975629667
• nixpkgs rev: 92f41becba5701c37372ad1a990a31893779b43d

Verify locally

gh run download <run-id> --name steward-smoke-<bundle> --dir ./artifact
trace bundle verify ./artifact  # bundle_id=d23c4c84ab95858e

Generated by trace.

[jasonodoom]

Comparison against the upstream fix

Transcription lane (this PR's payload). The added and removed code lines of the embedded patch (src/dec/vp8l_dec.c, src/utils/huffman_utils.c, src/utils/huffman_utils.h) are identical to the upstream fix commit libwebp 2af26267, normalized for whitespace; the only difference is the git format-patch trailer line, which is not code. The cross-family Reviewer attested this; the check here was recomputed independently against the bundle's upstream-fix.patch. The Linux cert (trace run 33975629667) built libwebp at the pinned revision with and without the patch: the unpatched arm fired the discriminator, the patched arm was clean.

Blind-authoring lane (separate measurement, not this payload). When the same CVE was given to claude-opus-4-8 with only the vulnerability description and the pre-fix source, never the upstream patch, the graded result against the human fix was WRONG: it added a check after BuildHuffmanTable had already written into the table, so the heap overflow remained. Report: trace data/reports/authoring-accuracy-vs-human-2026-09-04.json.

The gap between the two lanes is the case for the gate. This 340-line fix is the largest backport on the fork so far, and the blind lane did not reproduce its chained-allocation redesign.