fix(deps): update russh, DOMPurify, and gateway base

[alangou]

Summary

Update vulnerable runtime and tooling dependencies to patched upstream releases, including the pinned gateway base image.

Related Issue

No public issue: this dependency remediation follows published upstream advisories, and SECURITY.md directs vulnerability reports away from GitHub.

Changes

• Update russh to 0.61.2 and adapt SSH key generation and channel data handling to its current API
• Resolve russh-cryptovec 0.61.0 through the updated dependency graph
• Pin DOMPurify 3.4.12 through the Mermaid tooling override and lockfile
• Update the pinned Debian 13 distroless gateway base to a patched multi-architecture digest

Testing

• mise run pre-commit
• mise run test
• mise run e2e:rust (95 passed)
• mise run e2e:python (87 passed, 84 skipped)
• mise run e2e:mcp (3 scenarios passed)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 62bacbd. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.