fix(security-tools): pick up the cryptography + aiohttp CVE fixes

Cascade-mirror delivery of the four fleet-canonical files under
.claude/hooks/fleet/setup-security-tools/, byte-identical to
socket-wheelhouse template@3e068f61b.

Clears the 5 open Dependabot alerts this repo reports, all of which resolve
to the two vendored uv.lock closures rather than to anything in this repo:

  cryptography  48.0.1 -> 50.0.0   GHSA-g6cj-pr64-35w5  high
  aiohttp       3.14.1 -> 3.14.3   GHSA-cq5v-8q36-5273  high
                                   GHSA-mfx4-hv73-q22v  medium
                                   GHSA-mq44-7p77-q5h7  medium

No repo-local content is touched. The paired pyproject.toml files carry the
dated soak exceptions each bump needs; cryptography 50.0.0 is a
user-authorized bypass expiring 2026-08-07, aiohttp 3.14.3 is already
soaked.

Author: jdalton

.claude/hooks/fleet/setup-security-tools/headroom/pyproject.toml

@@ -49,11 +49,18 @@ exclude-newer = "2026-06-10T00:00:00Z"
 # - mcp < 1.28.1 is a high Dependabot advisory; 1.28.1 published 2026-06-26 (already
 #   past the 7-day soak). The 06-27 cutoff pins 1.28.1 and excludes the 2.0.0b2
 #   prerelease (2026-07-14). Drop once the global exclude-newer advances past it.
-exclude-newer-package = { headroom-ai = "2026-07-04T00:00:00Z", mcp = "2026-06-27T00:00:00Z", pydantic-settings = "2026-06-20T00:00:00Z", starlette = "2026-06-13T00:00:00Z" }
+# - cryptography < 50.0.0 carries GHSA-g6cj-pr64-35w5 (high); 50.0.0 published
+#   2026-07-31, so it is 4 days inside the 7-day window. User-authorized
+#   soak-bypass for an emergency CVE patch; drop once it clears 2026-08-07.
+# - aiohttp < 3.14.3 carries GHSA-cq5v-8q36-5273 (high) plus GHSA-mfx4-hv73-q22v
+#   and GHSA-mq44-7p77-q5h7 (both medium, fixed in 3.14.2). 3.14.3 published
+#   2026-07-23 and is already past the soak, so this is a plain floor bump
+#   rather than a bypass. Drop once the global exclude-newer advances past it.
+exclude-newer-package = { aiohttp = "2026-07-24T00:00:00Z", cryptography = "2026-08-01T00:00:00Z", headroom-ai = "2026-07-04T00:00:00Z", mcp = "2026-06-27T00:00:00Z", pydantic-settings = "2026-06-20T00:00:00Z", starlette = "2026-06-13T00:00:00Z" }
 # Force the security-fixed floors past headroom-ai 0.24.0's transitive caps:
 # litellm < 1.84.0 carries 6 critical advisories (GHSA-4xpc-pv4p-pm3w et al.);
 # 1.84.6 (2026-06-09) is the latest soaked fix. starlette per the note above.
 # mcp < 1.28.1 is a high Dependabot advisory; 1.28.1 is the patched floor.
-override-dependencies = ["litellm>=1.84.6", "mcp>=1.28.1", "pydantic-settings>=2.14.2", "starlette>=1.3.1"]
+override-dependencies = ["aiohttp>=3.14.3", "cryptography>=50.0.0", "litellm>=1.84.6", "mcp>=1.28.1", "pydantic-settings>=2.14.2", "starlette>=1.3.1"]
 # Use only the uv-managed CPython under the _dlx store — never a system Python.
 python-preference = "only-managed"