[al2wang]

cargo deny check (the first command in the Dependency and license policy step) now fails on current main (3e2896c). It reports four advisories against rustls 0.23.45:

advisory	summary	rustls fix	fixed in
RUSTSEC-2026-0346	Debug impls for client session values expose TLS secrets	rustls/rustls#3299	≥ 0.23.46
RUSTSEC-2026-0347	buffered application data sent to the outer server after ECH rejection	rustls/rustls#3300	≥ 0.23.46
RUSTSEC-2026-0348	Brotli certificate decompression can allocate up to 1 GiB before authentication	rustls/rustls#3297	≥ 0.23.46
RUSTSEC-2026-0349	unauthenticated ServerHello can downgrade later connections to classical key exchange	rustls/rustls#3355	≥ 0.23.46

This PR is a lockfile-only bump to 0.23.46 (cargo update -p rustls --precise 0.23.46). No other crate version moves. rustls 0.23.46 has the same dependency requirements as 0.23.45. The rustls = "0.23.45" requirement in crates/execution/Cargo.toml is a caret requirement and already admits 0.23.46, so it stays as is.

Context: every PR whose plan selects the policy step currently fails on these advisories regardless of its own content. #100 hits them in run 38609470613 (linux job, "Dependency and license policy"), and that failure fails its required source-gate. Landing this separately unblocks #100 without changing it.

Validation (local, Rust 1.89, cargo-deny 0.20.2 / cargo-audit 0.22.2 / cargo-about 0.9.2 as pinned in CI):

• cargo deny check advisories bans licenses sources: advisories ok, bans ok, licenses ok, sources ok, with no RUSTSEC findings. Control on the same advisory-db snapshot (caee11f): main reports exactly RUSTSEC-2026-0346, 0347, 0348 and 0349 and nothing else; this branch reports none.
• Full policy step (cargo deny check, cargo about generate about.hbs with the serde/MIT checks, tests/test-supply-chain.sh): pass.
• cargo fmt --all -- --check: pass.
• cargo clippy --locked --workspace --all-targets -- -D warnings: pass.
• cargo test --locked --workspace: 848 passed, 0 failed (54 suites), including the sandbox tests.

🤖 Generated with Claude Code

[weiddeng]

LGTM. This is a minimal lockfile-only rustls 0.23.45 → 0.23.46 update; the existing caret requirement admits the patch release, no other dependency entries move, and 0.23.46 is the patched version for RUSTSEC-2026-0346 through -0349. The full CI and required source gate pass.