[lance0]

Patch the published ctutils constant-time and Tokio I/O-safety advisories in the controller and separate fuzz dependency graphs.

• ctutils becomes 0.4.4 in both graphs.
• Tokio becomes 1.53.3 in both graphs. Fuzz also needs Mio 1.2.0 and tokio-macros 2.7.0 to satisfy Tokio's published ranges; the controller already has them.
• Only versions and checksums in the two lockfiles change. Manifests and the documented optional SQLx/MySQL RSA exception remain unchanged.

Published archive checksums, advisory ranges and compiler minimums were independently verified. Both locked graphs resolve, both audits and dependency policy pass, and strict Clippy passes in both backend configurations. Exact head 14e81a1 passes all 18 hosted checks, including Rust 1.89, backend/PostgreSQL tests, released-speaker fixtures, frontend, smoke/interop and both Docker images. Native fuzz-bin compilation and all 548 dependency-branch library tests also pass. The native pre-PR gate stops in the inherited hey parser, removed by #327; no full native gate pass is claimed for this head.

Sources: ctutils security release, Tokio advisory.

Merge order: #323 → #327 → #322 → #324 → #325 → #326. Use merge commits; after the predecessor lands, retarget the next PR to main before merging.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.