fix: bound Thrift compact varint reads

[cristibleotiu]

Summary

• backport the official Apache Thrift 10-byte compact-protocol varint bound for CVE-2026-43871
• add regressions for overlong input and the valid 10-byte boundary
• pin implementation/test hashes and record the exact v0.23.0 fixed decision in OpenVEX
• run the Thrift package regression inside every candidate image build

Why

Post-merge CI run https://github.com/Ratio1/r1-meshdb/actions/runs/33728020657 passed source, build, image, cluster, console, rolling-upgrade, recovery, and SBOM gates, then failed the final scan after the September 3 Trivy database update identified CVE-2026-43871 in github.com/apache/thrift@v0.23.0. The passing PR head and merged commit had identical trees, so this was advisory-database drift rather than a merge-content regression.

The behavioral change is the exact Go fix from Apache Thrift commit apache/thrift@d515221. The module version remains v0.23.0 to avoid an unrelated dependency upgrade; provenance and VEX bind the backport to the exact preimage and result hashes.

Validation

• focused Thrift regression with pinned Go 1.26.6: pass
• full Python contract suite: 87 tests pass
• exact upstream provenance regeneration: 155 generated outputs and 3,505 retained files verified
• scratch candidate image build: pass
• local direct and Deeploy-style three-node testbeds: pass
• authenticated TLS browser console/API smoke: pass
• persisted legacy/candidate rolling upgrade and rollback: pass
• runtime supervision and multi-node corrupt-store recovery: pass
• image/source SPDX and CycloneDX semantic plus schema validation: pass
• Trivy 0.73.0 current DB: raw scan reports CVE-2026-43871; reviewed VEX scan reports zero high/critical findings