Update certificate trust and dependencies, improve interactive workflows and
diagnostics, and clarify handling of conflicting installations.

Security

• Reject compromised eMudhra/emSign intermediate certificates with
  rustls-webpki 0.103.16 and remove the affected root from bundled certificate
  stores with roots 1.0.11. This addresses the risk of TLS endpoint impersonation,
  including relay connections and Android HTTPS. These three advisories cover
  the same CA incident (RUSTSEC-2026-0382,
  0381,
  0383).

Changed

• Update the pinned ngit-grasp integration-test fixture from 3.0.7 to 3.0.9
  so compatibility checks exercise the current server release.
• Refresh the pinned nixpkgs, rust-overlay, and crane inputs for Nix builds
  and development. The development toolchain moves to Rust 1.99.1; the Nix
  Linux package uses OpenSSL 3.5.9 LTS. Keep Intel macOS on the supported
  nixpkgs 26.05 branch after unstable dropped that platform.
  The native OpenSSL update also includes the crafted-certificate allocation
  fix (CVE-2026-35189)
  for Nix-installed ngit; downloadable archives use a separate vendored version.
• Refresh Rustls, ZIP, Negentropy, ctutils, faster-hex, and Tokio, including
  upstream security and safety fixes for which no affected production path was
  identified in ngit. Adapt APK filename decoding to ZIP 9.
• Replace deprecated serde_yaml and its unmaintained unsafe-libyaml dependency
  with serde-saphyr 2.0.0 for release manifests, container manifests, and legacy
  maintainers.yaml files. Preserve tested parsing and configuration round-trip
  behavior, including strict booleans and literal merge keys, without adding
  source snippets to error messages.
• Refresh serde_json to 1.0.154, passwords to 3.1.19, tokio-util to 0.7.20,
  tokio-rustls to 0.26.6, libc to 0.2.191, hyper to 1.12.0, and hyper-util to
  0.1.21 within the existing dependency requirements.
• Refresh mailparse, zeroize, and rstest alongside the security dependency updates.

Fixed

• Prompt for missing account names, comment bodies, labels, subjects and cover
  notes with --interactive. Preserve supplied values and reject missing or
  blank required input before creating accounts or publishing edits.

• Set up remote tracking after interactive patch checkouts. Interactive PR
  checkout now shares the ordinary checkout logic for updates and protection
  of unpublished commits.

• Honor status and label filters and offline mode in the interactive PR menu.
  Show the requested PR when an ID is supplied instead of opening the menu.

• Make ngit issue create --interactive prompt for missing subject, body and
  labels instead of rejecting the subject or publishing an empty body without
  asking. Preserve explicit values and use --subject in missing-input errors.
  Correct the global help text: interactive prompts are opt-in where supported.

• Shorten error messages to focused recovery steps while retaining source
  details, grouped relay results and underlying causes. Repository-selection
  guidance now includes both nostr.repo and Git remotes.

• Keep related-repository lookup diagnostics explicit about unavailable
  search history instead of claiming that no Nostr relays were searched.

• Include paths and access guidance when Git repositories or signing-key
  files cannot be opened, while preserving the underlying filesystem error.

• Retain Git server and connection-method failures when fetching commits.
  Explain relay timeouts, incomplete searches and publication failures in
  plain language, including the possibility of partially accepted updates.

• Use consistent account and signing-key guidance for missing passwords,
  invalid keys and account mismatches. Explain rejected remote signatures
  without requiring knowledge of Nostr key or event terminology.

• Give issue, PR and comment lookup failures consistent guidance for finding
  the ID, checking the selected repository and refreshing offline data.

• Explain how to correct repository selection and malformed nostr.repo
  settings. Retain the actual resolution failure for explicit remote names
  and Nostr URLs instead of reporting every failure as invalid input.

• Apply source-aware repository lookup diagnostics across commands, including
  offline reads, repository membership, sync and publishing. Preserve lookup
  categories and per-relay outcomes in JSON errors.

• Make ngit init lookup errors show the selected repository source and Nostr
  relay outcomes instead of calling the repository name a coordinate. Keep
  the warning about creating an announcement with ngit init --force.

• Make repository lookup errors identify the Git remote, URL, nostr.repo
  setting or --repo value to check. Group Nostr relays by whether they
  responded without the repository, returned unusable data, or could not be
  checked, with reasons for failed searches. When no search completes, report
  that the repository could not be checked rather than implying it is missing.

• Explain when Git uses a different ngit helper, including an older copy in
  Git's own executable directory, even when ngit update says ngit is current.
  A conflicting copy still needs cleanup through its original installation
  method unless both copies are complete, verified standalone installations
  with installer receipts. Only those copies can be consolidated automatically.
  If Git lookup is unavailable, ordinary installs and updates continue with a
  warning; automatic cleanup remains disabled.
  On Windows, unresponsive version checks time out instead of hanging the installer.