chore(release): record v0.33 advisory decisions

[jeremi]

Bind all six v0.33.0 image advisory baselines to the exact Linux AMD64 evidence from rehearsal 35711552030, source 6a460c2cf66bc9d286cbe4a5454571c392488c05. This adds the first reviewed Scheduling baseline and updates independent live test pins, leaving historical release artifacts unchanged.

The review confirms the pinned runtime base, ordered rootfs layers, production process configuration, and Syft-bound executable and library hashes. It renews the existing libc/zlib decisions and deliberately adds the newly reported CVE-2026-19499 after checking direct and indirect call paths. The three scoped exceptions expire on 2026-10-06 and remain invalidated by changed bytes, configuration, findings, or an available distribution fix.

Refresh the existing Rhai/smartstring decision comments for the reviewed bounded conversion paths and current Rhai version. The parsed cargo-deny policy and all eight advisory ignores are unchanged; the residual-risk decision has a 2026-10-06 review deadline.

Validation: all six exact image checks report three covered blocking findings and zero invalid exceptions; the final renewal dry run reports zero files to change; the advisory suite runs 49 tests with one expected skip. The bootstrap rehearsal's canonical Linux evidence job passed; its ordinary rehearsal job stopped at the then-missing Scheduling baseline, as the onboarding runbook requires. The strict prepared-release rehearsal remains required before the version PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T11:09:00.495349Z	4a3d8c6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a3d8c6952

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".