fix(deps): bump zip 2.4.2 -> >=9.0.5 for zip2 CVEs (pre_seed) #1579

Description

openab-core depends on the zip crate (zip-rs/zip2) 2.x, locked at 2.4.2 in Cargo.lock. A recent advisory covers zip up to and including 9.0.4, with the fix in 9.0.5. It lists four CVEs: CVE-2026-115905, CVE-2026-115907, CVE-2026-115908 and CVE-2026-115909.

Where it's used:

• crates/openab-core/Cargo.toml:44 has zip = { version = "2", default-features = false, features = ["deflate"], optional = true }.
• The dependency is only enabled by the pre-seed feature (pre-seed = [..., "dep:zip", ...]), which arrived in feat: add pre_seed phase — S3 zip download before pre_boot #1189.
• The only call site is crates/openab-core/src/pre_seed.rs. extract_zip_budgeted runs zip::ZipArchive::new on the archive bytes downloaded from S3, then iterates by_index, calling enclosed_name() and std::io::copy for each entry.

Exposure (my reading, not verified against the advisory's PoCs):

• Symlink escape (-115908): probably low. pre_seed doesn't call ZipArchive::extract and only writes regular files and directories through enclosed_name().
• Stream reader (-115905): not applicable. No ZipStreamReader / read_zipfile_from_stream usage.
• ZIP64 DoS (-115907 / -115909): plausibly applicable. The issues are in central-directory parsing, which ZipArchive::new does on the downloaded bytes before any of the existing entry-count, size and deadline limits run.

The archive source is operator-configured S3, so an attacker would need write access to the bucket. Even so, a vulnerable parser on startup input is worth fixing.

Steps to Reproduce

1. On main, check the resolved version: grep -A1 'name = "zip"' Cargo.lock shows version = "2.4.2". Alternatively, run cargo tree -p openab-core --features pre-seed -i zip.
2. Run cargo audit (or check the zip-rs/zip2 advisory). zip 2.4.2 falls in the affected range (<= 9.0.4).
3. Runtime path: build with --features pre-seed, configure a hooks.pre_seed layer that points at an S3 object, and start openab. The downloaded bytes go straight to zip::ZipArchive::new in extract_zip_budgeted. A crafted ZIP64 archive at that location reaches the affected parsing code.

Expected Behavior

• openab-core resolves zip >= 9.0.5, for example zip = { version = "9.1.2", default-features = false, features = ["deflate"], optional = true } plus cargo update -p zip.
• cargo audit reports none of the four CVEs.
• pre_seed zip extraction behaves the same as today. cargo check, cargo test -p openab-core --features pre-seed and cargo clippy --all-targets -- -D warnings pass.

Environment

• openab main @ d59f7de2cc
• zip 2.4.2 (resolved), only behind the pre-seed feature

Notes on the fix

This is a major jump from 2.x. The APIs pre_seed.rs uses (ZipArchive::new, by_index, enclosed_name, is_dir, size, unix_mode) still exist in 9.x, but CI needs to confirm the build. zip 9.x needs Rust >= 1.88, and the rust:1-bookworm builder images should satisfy that.