fix(deps): patch certificate-trust advisories before 0.5.0 #1128

The scheduled security audit on main (d5e826c) fails on two related certificate-trust advisories:

• rustls-webpki 0.103.15: RUSTSEC-2026-0382, patched in 0.103.16.
• webpki-root-certs 1.0.9: RUSTSEC-2026-0383, patched in 1.0.10.

Failed audit log.

Update those two transitive lockfile entries before 0.5.0, preserving the existing dependency constraints and avoiding unrelated upgrades. Validate with cargo audit --deny warnings, the repository formatting/clippy/test gates, and the declared Rust 1.94 checks.

The verifier is in the Linux CLI runtime dependency tree. The bundled-root crate is included by rustls-platform-verifier only for WebAssembly, but still needs the patch for the whole-lockfile audit. Existing dependency PRs #1123 and #1124 retain both affected versions.