[AnthonyRonning]

Independent component lockfiles still resolve packages affected by RUSTSEC-2026-0385 and RUSTSEC-2026-0386. Update ctutils to 0.4.4 in OpenSecret and Research, and Tokio to a patched release in all five affected components. OpenSecret uses the minimum patched 1.51.6 line with its required dependencies; Agent, Research, SDK and Proxy use 1.53.3. No advisory ignores or manifest requirements change.

The scheduled macOS Store benchmark also exceeded its keyed 50-row list median budget by 19 microseconds (1,019 versus 1,000). Raise only that full macOS budget to 1,250 microseconds. This is explicit policy headroom, not a statistically established runner-variance allowance. Linux's diagnostic target, relative comparisons, fixture/query-plan checks and other absolute limits retain their existing behavior.

Validation:

• All five components' configured advisories/bans audits pass with their selected toolchains and no new ignores; Agent's audit covers all three target platforms.
• All 25 evaluator tests pass, including the new inclusive boundary, observed result, unchanged Linux diagnostic and a relative regression below the new absolute limit.
• OpenSecret formatting, strict all-target/all-feature Clippy and full-feature tests pass: 868 passed, 34 ignored.
• Normal commit hooks passed for Research, SDK, Proxy, Agent and OpenSecret, including each component's required Rust compilation/tests, Clippy and documentation checks where applicable.
• Final root nix flake check --no-update-lock-file --print-build-logs passed on aarch64-darwin. Hosted validation is pending.

The original benchmark artifact still produces needs_decision for a separate oversized-row collection result of 63.339 ms against its 50 ms target. Replaying the artifact confirms that this change accepts the narrow list miss while preserving that separate blocker. Reference baselines remain unchanged.

Sources: ctutils advisory, Tokio advisory, measured macOS benchmark.

Refs #1224.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}