[High] Patch rust for CVE-2026-82254

[BinduSri-6522866]

Summary:
Patch rust for CVE-2026-82254
Commits 1–6: zero deviations — same as upstream. But 5 deviations are in commit 7.

1. GitoxideLabs/gitoxide@0be338f — 2024-02-05 — Prerequisite: Handle OOM when copying to buffers. Adds Error::OutOfMemory and impl From for Error, plus the first try_reserve calls.
2. GitoxideLabs/gitoxide@2a9ef4e — 2024-02-06 — Prerequisite: refactor — moves set_vec_to_slice from lib.rs to cache/mod.rs, changes Result→Option, adds the checked_sub/try_reserve pattern in decode/entry.rs. ← was missing from your list
3. GitoxideLabs/gitoxide@b32a847 — 2024-05-12 16:24 — Prerequisite: don't panic on unknown entry types (from_bytes → Result<data::Entry, Error>).
4. GitoxideLabs/gitoxide@bad5b48 — 2024-05-12 16:58 — Prerequisite: adapt gix-odb to commit 3 (34 min later, same day).
5. GitoxideLabs/gitoxide@fce7095 — 2025-06-24 — Prerequisite: delta application is a fallible operation (gix-pack: delta application is a fallible operation GitoxideLabs/gitoxide#2059).
6. GitoxideLabs/gitoxide@56ca4bf — 2025-06-25 — Prerequisite: refactor — put error into a more specific spot and export it (pub enum Error → pub mod apply { pub enum Error }).
7. GitoxideLabs/gitoxide@1dc8ede — 2026-04-22 — the CVE-2026-82254 fix.

5 deviations are in commit 7:

1. vendor/gix-pack/src/data/delta.rs — commit bzip2: Fix Makefile patch breaking the package build #7 1dc8ede
   Commit bzip2: Fix Makefile patch breaking the package build #7's only edit here is the rename i → shift, which the patch applies exactly; upstream's u64::from(*cmd) styling is untouched context from 29ad2df41, a clippy cleanup outside our 7 commits. Patch keeps the 0.44 form (*cmd as u64 & 0x7f) << shift
2. vendor/gix-pack/src/data/entry/decode.rs — commit bzip2: Fix Makefile patch breaking the package build #7 1dc8ede
   ObjectId::from_bytes_or_panic does not exist in vendored gix-hash 0.13.1 — using it yields error[E0599]; From<&[u8]> is the identical conversion under the older name.
3. vendor/gix-pack/src/data/file/init.rs — commit bzip2: Fix Makefile patch breaking the package build #7 1dc8ede
   Upstream's doc references Self::from_data(), which doesn't exist in 0.44.0 — it comes from 3ef391613 ("parameterize data"), a feature commit correctly excluded from a CVE backport. Patch uses upstream's own alternative wording from the same commit, which accurately describes our at() and keeps intra-doc links resolvable.
4. vendor/gix-pack/src/multi_index/init.rs — commit bzip2: Fix Makefile patch breaking the package build #7 1dc8ede
   File is not generic in 0.44.0 (generic File and the public from_data() wrapper also come from the un-backported 3ef391613), so Filecrate::MMap and data: T cannot compile here. Patch uses concrete impl File / data: Mmap with the helper kept private and doc links retargeted to File::at(); the alloc_limit_bytes cap is present and identical to upstream.
5. multi_index/write.rs — upstream made write_from_index_paths a free function; ours is still a method. Applying the hunk would replace working doc links with broken ones, and its pre-image text doesn't match our file, so it could not apply cleanly in any case.

Additinally test/ folder is not present, so test changes are not applied.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Kavya Sree Kaitepalli (KavyaSree2610)]

Buddy build : https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1210289&view=results

[Kavya Sree Kaitepalli (KavyaSree2610)]

Patch applied cleanly, Buddy build is successful, LGTM