Track upstream Extism fix for Wasmtime advisories

[lightcap]

Summary

The Rust SDK currently carries temporary cargo-deny advisory ignores for Wasmtime advisories that are upstream-blocked by extism = 1.21.0 requiring wasmtime = ^41.

The SDK executes vendor-provided 1Password wasm/core.wasm only, not arbitrary user-supplied WASM, so the trust boundary is materially narrower than a general plugin host. Still, several advisories include critical sandbox-escape issues and should be removed as soon as upstream support is available.

Upstream blocker

• extism/extism#898: Upgrade to wasmtime 42+
• extism/extism#901: Upgrade wasmtime to v43
• Current latest release: extism v1.21.0, which still depends on Wasmtime 41
• Cargo cannot update wasmtime to 42/43 directly because extism v1.21.0 requires wasmtime = ^41

Temporary ignores

deny.toml ignores these advisories with unused-ignored-advisory = "deny" so stale exceptions fail CI:

• RUSTSEC-2026-0085
• RUSTSEC-2026-0086
• RUSTSEC-2026-0087
• RUSTSEC-2026-0088
• RUSTSEC-2026-0089
• RUSTSEC-2026-0091
• RUSTSEC-2026-0092
• RUSTSEC-2026-0093
• RUSTSEC-2026-0094
• RUSTSEC-2026-0095
• RUSTSEC-2026-0096
• RUSTSEC-2026-0114

Acceptance criteria

• Extism releases a version containing the Wasmtime 43 upgrade or another patched Wasmtime line.
• Update the SDK dependency/lockfile to the fixed Extism version.
• Remove the temporary advisory ignores from deny.toml.
• cargo deny check passes without Wasmtime advisory ignores.
• cargo fmt --check, cargo clippy --all-features -- -D warnings, and cargo test pass.

Related tracking

• Linear: https://linear.app/clipped-in/issue/CLI-96/track-upstream-extism-fix-for-wasmtime-advisories

[lightcap]

Added tracking automation in this branch:

• Weekly Cargo Dependabot updates via .github/dependabot.yml.
• A scheduled/manual Upstream Extism Watch workflow that runs cargo update -p extism -p extism-convert -p extism-convert-macros -p extism-manifest followed by cargo deny check advisories.
• With unused-ignored-advisory = "deny", the workflow should fail when an Extism update makes the temporary Wasmtime ignores stale, indicating this issue can be resolved.