#49 refactor(store): expose verified capture storage

The capture storage contract was embedded in the whatspec binary, while downstream tools independently implemented release lookup, archive extraction and hash verification. This extracts wa-store as a lightweight library that owns JS/wasm locks, exact-set restoration and selected historical wasm recovery without pulling in the protocol extractors.

The native fetch adapter now uses ureq 3.4, rustls 0.23.43 and OxiTLS/RustCrypto 0.3.0. CI gained explicit branch dispatch and dependency-advisory checks; the existing C-free and deterministic bundle-regeneration guarantees remain enforced.

Validation:

• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo build -p whatspec --no-default-features
• clean historical-capture restore through wa-store
• CI check + deterministic JS-bundle restore: https://github.com/oxidezap/whatspec/actions/runs/33983145320

---

Summary by cubic

Extracts capture storage from the whatspec binary into a new wa-store crate so downstream tools can verify JS/wasm locks, restore releases, and recover historical captures without pulling in the protocol extractors. The native fetch adapter now uses the OxiTLS/RustCrypto provider instead of the deprecated rustls-rustcrypto, and xz decompression moved to lzma-rust2 so dictionary memory is capped.

Refactors

• Release fallbacks reject untrusted redirects and skip invalid archives, continuing with the next available asset.
• Archive discovery stays bounded by download, decompressed, and file-count ceilings plus wasm size and asset pagination limits.
• whatspec's fetch feature now maps to wa-store/restore; --no-default-features still builds without the TLS stack.

Dependencies and CI

• Upgrades ureq to 3.4.0 and rustls to 0.23.43.
• CI gains workflow_dispatch and cargo-deny advisory checks, with deny.toml ignoring two advisories unreachable from the client-only TLS path.

Summary by CodeRabbit

• New Features

  • Added reusable storage support for tracking pinned JavaScript and WebAssembly assets.
  • Added verified restoration of WebAssembly files from local files, CDN sources, and selected release archives.
  • Added integrity checks using hashes, sizes, filenames, and lockfile consistency validation.
  • Updated the command-line tooling to use the shared storage and restoration capabilities.

• Documentation

  • Clarified reproducibility guidance, storage responsibilities, and supported TLS provider details.