fix(ci): resolve all CI failures

- deny.toml: remove deprecated [licenses].deny key (cargo-deny 0.19)
- deny.toml: ignore RUSTSEC-2023-0071 (rsa Marvin Attack, no upstream patch)
- ci: add fs-libs checkout step for CLI build job
- cargo update: quinn-proto 0.11.13->0.11.14, rustls-webpki 0.103.9->0.103.10
- remove unused thiserror dep from fs-builder, fs-deploy, fs-s3

Author: FreeSynergy

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Checkout fs-libs
+        run: git clone --depth=1 "https://x-access-token:${{ secrets.FS_LIBS_TOKEN }}@github.com/FreeSynergy/fs-libs.git" "${{ github.workspace }}/../fs-libs"
+
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy

cli/Cargo.lock

@@ -19,7 +19,6 @@ serde_json = { workspace = true }
 serde_yml  = { workspace = true }
 toml       = { workspace = true }
 anyhow     = { workspace = true }
-thiserror  = { workspace = true }
 clap       = { workspace = true }
 tracing    = { workspace = true }
 tracing-subscriber = { workspace = true }

cli/crates/fs-builder/Cargo.toml

@@ -21,7 +21,6 @@ serde_json         = { workspace = true }
 toml               = { workspace = true }
 indexmap           = { workspace = true }
 anyhow             = { workspace = true }
-thiserror          = { workspace = true }
 tokio              = { workspace = true }
 reqwest            = { workspace = true }
 tracing            = { workspace = true }

cli/crates/fs-deploy/Cargo.toml

@@ -34,7 +34,6 @@ toml       = { workspace = true }
 
 # Error handling
 anyhow    = { workspace = true }
-thiserror = { workspace = true }
 
 # Logging
 tracing = { workspace = true }

cli/crates/fs-s3/Cargo.toml

@@ -7,6 +7,11 @@ exclude-dev = false
 # Deny crates with known security vulnerabilities
 version = 2
 yanked = "deny"
+ignore = [
+    # rsa: Marvin Attack timing sidechannel — no upstream patch available yet
+    # Used transitively via russh-keys. Acceptable for internal SSH auth.
+    "RUSTSEC-2023-0071",
+]
 
 [licenses]
 version = 2
@@ -23,7 +28,6 @@ allow = [
     "OpenSSL",
     "Zlib",
 ]
-deny = []
 # Ring has a non-standard license — allow it explicitly
 exceptions = [
     { allow = ["ISC", "MIT", "OpenSSL"], name = "ring" },