[SDAChess]

Summary

Update russh to 0.64.1, the first patched release for GHSA-4wc5-f2rc-q74m (CVE-2026-111061).

Related Issue

Automated dependency update for Dependabot alert 55; uses the dependency-update exception to the separate issue requirement.

Upstream: russh 0.64.1 release.

Changes

• Raise the minimum russh version to 0.64.1 in openshell-server and openshell-supervisor-process.
• Update the workspace lockfile from russh 0.63.3 to 0.64.1 without other dependency changes.

Release Notes

Testing

• cargo test --locked -p openshell-supervisor-process -p openshell-server --lib
• cargo clippy --locked -p openshell-supervisor-process -p openshell-server --all-targets -- -D warnings
• cargo check --locked -p openshell-gateway -p openshell-supervisor --all-targets
• cargo fmt --all -- --check
• tasks/scripts/check-cargo-lockfiles.sh
• cargo tree --locked -i russh resolves only 0.64.1.

Checks ran through nix develop. The repository-wide pre-commit hook failed provisioning unrelated Python and Node tools; the maintainer explicitly authorized bypassing the hook for this commit. Existing SSH regression tests pass; no application code changed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs: not applicable to this dependency update.

[github-actions]

Label test:e2e applied for f5a6636. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.