Built on spike S4. Adds ureq (rustls) and zip 9 (zip 2 has open advisories),
and a deny.toml exception for webpki-roots' CDLA-Permissive-2.0 licence.
Plan in docs/superpowers/plans/2026-10-21-starter-sets-core.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -0,0 +40,4 @@
+            /opt/rust/cargo/registry/cache
+          key: presets-deps-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            presets-deps-

@@ -113,6 +116,9 @@ impl Db {
 
     fn try_open(path: &Path, steps: &[&str]) -> Result<Db> {
         let mut conn = Connection::open(path)?;
+        // The task runner has its own connection: wait for a write lock

@@ -0,0 +173,4 @@
+            let _ = t.join();
+        }
+    }
+}

@@ -0,0 +125,4 @@
+        if let Err(e) = self.db.start_task(task.id) {
+            return self.emit(Event::Error(format!("tasks: {e}")));
+        }
+        self.current = Some((module.clone(), false));

@@ -0,0 +205,4 @@
+    /// A download event: progress goes to the table and the listener, and
+    /// commands that arrived meanwhile are handled (a cancel stops it).
+    fn on_download(&mut self, rx: &Receiver<(u64, Command)>, task: &Task, ev: &install::Event) {
+        let progress = match *ev {

@@ -0,0 +45,4 @@
+        let agent = Agent::config_builder()
+            .timeout_connect(Some(Duration::from_secs(15)))
+            .timeout_recv_response(Some(Duration::from_secs(30)))
+            .timeout_recv_body(Some(opts.chunk_timeout))

@@ -0,0 +62,4 @@
+    for i in 0..zip.len() {
+        let mut entry = zip.by_index(i).map_err(|e| bad(e.to_string()))?;
+        let rel = entry.enclosed_name().ok_or_else(|| bad(format!("unsafe path {:?}", entry.name())))?;
+        if entry.is_dir() {

@@ -0,0 +207,4 @@
+        Ok(DataPath::Prefix { dir: parts.iter().collect(), stem })
+    }
+
+    /// Whether `file` (relative to the SWORD folder) is under this path.

@@ -0,0 +64,4 @@
+          if echo "$open" | grep -q "\"title\":\"$title\""; then
+            id=$(echo "$open" | grep -o '"number":[0-9]*' | head -1 | cut -d: -f2)
+            body="{\"body\":\"Still failing: $RUN\"}"
+            curl -fsS -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" -d "$body" "$API/issues/$id/comments" || true