deps: port node-forge to x509-cert 0.3

[proggeramlug]

Summary

Ports the native node-forge certificate builder and stdlib X509 parser to x509-cert 0.3 and its DER/SPKI 0.8 stack. The port preserves caller-controlled issuer names, exact validity bounds, extension criticality, and the no-implicit-extensions behavior used by Socket Firewall TLS certificates.

Changes

• Add a custom BuilderProfile equivalent to the removed Profile::Manual variant.
• Migrate validity, name/RDN construction, extension criticality, certificate builder, and public accessor APIs.
• Align the node-forge RSA/SHA/RNG stack with signature 3 as required by the new builder.
• Update the stdlib X509 reader to use the new public certificate/name accessors while retaining SPKI 0.7 for jsonwebtoken compatibility.
• Extend regression coverage for exact validity, distinct leaf issuer DNs, and absence of profile-injected extensions.

Related issue

Closes #8436

Test plan

• CARGO_INCREMENTAL=0 CARGO_PROFILE_TEST_DEBUG=0 cargo +nightly-2026-08-20 test -p perry-ext-node-forge (8 unit tests and the OpenSSL CA/leaf end-to-end test pass)
• CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 cargo +nightly-2026-08-20 check -p perry-stdlib --lib --no-default-features --features crypto
• CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 cargo +nightly-2026-08-20 clippy -p perry-ext-node-forge --all-targets (passes; existing warnings remain in dependency crates)
• cargo +nightly-2026-08-20 fmt -- crates/perry-ext-node-forge/src/crypto.rs crates/perry-stdlib/src/crypto/x509.rs --check
• Full workspace release build/test not run locally
• Added or updated tests in the affected crate
• Documentation update not required; no user-facing API changed
• Platform UI build not applicable

Note: adding -D warnings to the scoped Clippy command currently stops on a pre-existing clippy::type_complexity warning in crates/perry-runtime/build.rs:475.

Screenshots / output

Not applicable.

Checklist

• I have NOT bumped the workspace version or edited CLAUDE.md / CHANGELOG.md
• My commit follows the repository prefix convention
• I have read CONTRIBUTING.md and agree to the Code of Conduct

Summary by CodeRabbit

• Improvements
  • Updated X.509 certificate handling for improved compatibility with current certificate formats and APIs.
  • Improved certificate creation, parsing, validation, and signature processing.
  • Enhanced RSA key generation and certificate validity checks.
  • Preserved certificate names, extensions, public keys, serial numbers, and issuer details during processing.
• Bug Fixes
  • Improved handling of certificate extensions and basic constraints.
  • Strengthened certificate verification behavior and related validation tests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0719d600-58c2-451e-93af-38c8ba718c38

📥 Commits

Reviewing files that changed from the base of the PR and between 4ee1d04 and 58fbcdd.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• crates/perry-ext-node-forge/Cargo.toml
• crates/perry-ext-node-forge/src/crypto.rs
• crates/perry-stdlib/Cargo.toml
• crates/perry-stdlib/src/crypto/x509.rs

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The RustCrypto X.509 dependencies now use newer compatible versions. Certificate generation and parsing use the x509-cert 0.3 APIs. Standard-library X.509 access uses accessor and iterator methods.

Changes

X.509 API migration

Layer / File(s)	Summary
Dependency and API alignment crates/perry-ext-node-forge/Cargo.toml, crates/perry-stdlib/Cargo.toml, crates/perry-ext-node-forge/src/crypto.rs	RustCrypto PKI dependencies and imports now target the updated DER, SPKI, OID, RSA, randomness, and X.509 APIs.
Certificate construction and validation crates/perry-ext-node-forge/src/crypto.rs	Certificate generation now uses ManualProfile, Criticality, Validity::new, explicit signing, and current distinguished-name APIs. Tests validate timestamps, issuer names, and extensions.
Standard-library X.509 accessors crates/perry-stdlib/src/crypto/x509.rs	X.509 names, extensions, signatures, keys, serial numbers, validity values, and properties now use accessor and iterator methods.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 58fbc

This dependency port preserves the documented certificate-building and parsing behavior, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: jdalton, thehypnoo

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.93% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 29 functions across 2 files. (2 skipped: 2 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The code addresses the linked API and behavior requirements, but Cargo.lock consistency cannot be verified because the file is excluded by !**/*.lock.	Verify that Cargo.lock resolves the required x509-cert 0.3, DER 0.8, SPKI, and const-oid dependency versions.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the dependency port from x509-cert 0.2 to 0.3.
Description check	✅ Passed	The description includes all required sections, explains the changes, references issue #8436, and documents scoped verification and limitations.
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the dependency upgrade, API migration, certificate behavior preservation, and regression tests described by issue #8436.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Merging as a validated batch. These six are the non-perf members of a nine-PR stack built on current main; the three perf PRs (#8568, #8570, #8573) are deliberately held back for measurement rather than merged on compile evidence.

Validation on the combined stack:

check	result
cargo check --workspace --all-targets	exit 0, zero errors
check_file_size.sh	0
workspace_architecture.py --check	0
raw_handle_debt.py	0
check_gc_scanner_latches.py	0
gc_runtime_root_holders.py	0
check_test_registration.py	0
cargo fmt --all -- --check	0

The stacked compile check is what per-PR CI cannot do: several of these touch the same files, and pairwise-green PRs can still break in combination.

The ratchets were re-run against the current baseline immediately before merging, not just during the initial audit. That distinction is not pedantry — #8560 passed raw_handle_debt at a baseline of 974, then #8559's cleanup lowered it to 925 and turned a legitimately-green change into a violation on main. A ratchet result is only valid as of the moment it ran.

Mechanical fixes applied while staging (these are fork PRs, so they could not be pushed to their branches): PR-keyed the changelog fragments for #8562 (was 8546-) and #8570 (was 8409-), and wrote the missing fragments for #8563, #8567 and #8574.