[AnthonyRonning]

Removes crypto-bigint 0.5 from the SDK dependency graph for RUSTSEC-2026-0387. P-256 and P-384 now use their 0.14 implementations, with an enforced crypto-bigint >=0.7.6 floor; SPKI encoding trait imports in two tests follow the new version. Removes the unused sev crate: the SDK already implements SEV-SNP verification in its own verifier modules.

The remaining old P-256 path came from HPKE defaults in EHBP. Vendors EHBP 0.3.1 at immutable upstream commit 93cc1fa1ad61e19f9a34fb23cb5b5d5635d3edb0 and selects only alloc/x25519, the suite this protocol uses. All Rust protocol source and test-vector bytes match upstream; provenance and MIT license are included. Its private prerelease version prevents a registry package from silently substituting the original default-feature graph. This fork is consumed through pinned Git, not a new registry publication.

Validation through the consuming OpenSecret pinned Nix/Rust environment: all-target cargo check; 277 SDK unit tests; 2 credential-free integration tests (21 live/provider tests ignored); 40 upstream EHBP tests/vectors; graph inspection confirms no crypto-bigint 0.5 or sev crate. Existing RSA public-verification advisory remains; no new advisory ignore is added.

CI adds the EHBP vectors on Linux with upstream default reqwest settings. Existing SDK tests keep ring-only TLS on Linux/macOS/Windows, and the existing MSRV job remains enabled. No provider API key is configured on this fork, and no authenticated model request was made. Full formatting reports pre-existing differences outside the edited imports; application/protocol source changes are otherwise limited to dependency selection.

This targets the maintained upstream-v0.2.1 adapter branch used by Maple, retaining its DirectPolicy, ApprovedRelease, PinnedRelease and new_direct contracts. Sigstore conformance CI is also enabled for that branch. This is the companion dependency fix for Maple #1258. No attestation policy, roots, wire format, release, or deployed service is changed.