fix(deps): remediate h2 advisory

[elezar]

Summary

Update the remaining h2 dependency to the RUSTSEC-2026-0258 fixed release after the legacy Rustls/WebPKI path is removed.

Related Issue

Depends on #3013. No public issue is created for this RustSec advisory remediation.

Changes

• Update h2 from 0.4.13 to 0.4.16 in Cargo.lock.
• Remove three Rustls/WebPKI advisory ignores made obsolete by chore(deps): remove legacy rustls webpki path #3013.

Testing

• mise run rust:deny passes.
• mise run pre-commit passes.
• E2E tests not run; dependency-only change.

Checklist

• Follows Conventional Commits.
• Commit is signed off.

[pimlock]

Updated h2 from 0.4.16 to 0.4.19 in commit 49bd145.

h2 0.4.16 introduced a fixed connection-wide budget for small HTTP/2 DATA frames. Upstream then reported false-positive GOAWAY too_many_data_frames errors under legitimate concurrent small responses: hyperium/h2#939.

This is relevant to OpenShell because tonic and hyper share h2 connections, so an unexpected connection abort can leave a test task waiting for its normal stream or shutdown path.

Releases 0.4.17 through 0.4.19 refined that accounting, including end-of-stream handling and a budget based on the connection window: hyperium/h2#946.

The replacement Branch Checks run is testing whether 0.4.19 removes the observed Rust test hang: https://github.com/NVIDIA/OpenShell/actions/runs/33662982312.

[pimlock]

Rerun result: updating h2 to 0.4.19 did not remove the stall. In Branch Checks run 33662982312, all three Rust jobs remained in the Test step after 15 minutes, beyond the longest comparable healthy job sampled at 14m17s. This weakens the h2 0.4.16 regression hypothesis as the sole cause. Commit caa6aae now limits the Rust matrix job to 30 minutes so future stalls terminate predictably. The next push-triggered run will exercise that limit.