ci: unblock Sprig publishing and clear RUSTSEC-2026-0224

[mattbalza]

Two independent CI failures, both red on every push to main.

Sprig — Publish rolling release

Failed in ~12s on every run, with both Build jobs green behind it. The log is one line:

release not found
##[error]Process completed with exit code 1.

.github/workflows/sprig.yml calls gh release edit sprig-latest with no create path, and
nothing else ever creates that release — publish-tag only cuts sprig-v*. gh release list
on this repo returns empty, so the step could never have succeeded here.

Fixed by making the step create-or-edit. Upstream has the same bug (any repo whose
sprig-latest has not been cut by hand fails identically); I'll send it to block/buzz
separately.

CI — Security

cargo-deny: advisories FAILED, bans ok, licenses ok, sources ok.

error[vulnerability] RUSTSEC-2026-0224 on nostr-relay-pool 0.44.1 — the crate inserted
the signature-verification cache entry before verifying, so a re-delivered event carrying a
forged signature hit the cache, skipped verification entirely, and reached
NostrDatabase::save_event(). CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — integrity only,
but it means arbitrary unsigned events can be persisted as trusted, i.e. impersonation of any
pubkey. 0.44.1 and 0.44.0 are both yanked; patched in 0.44.2.

The advisory was published today, which is why Security was green at 12:55 UTC and red at
19:22 — this is environmental, not caused by any PR.

Cherry-picked upstream's fix (block#4139, Cargo.lock only — nostr-sdk 0.44.1 requires
^0.44, so nothing else moves).

Supply-chain note

nostr-relay-pool 0.44.2 was published 2026-08-01T07:40:08Z, ~12.5h before this PR — inside
our 24h cooling-off window. Taken deliberately, with the owner's explicit sign-off, because the
alternative is running a yanked crate with an unpatched signature bypass on a production relay.
Recon before taking it:

• sole owner yukibtc, the same publisher as every prior 0.44.x
• repository github.com/rust-nostr/nostr matches the crate name
• 984k all-time / 505k recent downloads, 88 KB crate
• the fix is a one-line reorder of the cache insert; the same version is already on block/buzz main

Test plan

• cargo deny check advisories → advisories ok (exit 0); only the pre-existing non-fatal
  warning[yanked] spin 0.9.8 (flume → mdns-sd → mesh-llm-host-runtime) remains
• sprig.yml parses
• After merge: Sprig / Publish rolling release green and a sprig-latest prerelease
  created carrying both musl tarballs
• After merge: CI / Security green