#1040 certifi 2026.7.22 trusts emSign ECC Root CA - G3 (GHSA-6q48-6c7w-9gw2, compromised intermediates); DSL compiler pip-installs caller imports at runtime with pip's vendored certifi

EARS SPEC: - Every Highway image shall ship certifi >= 2026.10.19 (first patched release; removes emSign ECC Root CA - G3 only, verified against the wheel's cacert.pem: old bundle labels C1, C3, G1, G3; new C1, C3, G1). - The DSL compiler shall not install packages at compile time; it compiles only against its pinned, locked dependencies, and its image shall be built from a lock with pinned base image digest. CONTEXT: Provenance finding a110eda4 (via infra-manager, 2026-10-21) on highway_dsl main@a1a6eec; the same certifi is in highway-api, workers and highway-dsl-compiler (2026.07.22, checked in the running containers). The compiler (docker/dsl-compiler/compiler_service.py) runs 'pip install' for modules the caller's code imports, i.e. outbound TLS to PyPI with pip's own vendored certifi (2026.06.17 in the running compiler) and an arbitrary-package supply-chain path; its Dockerfile uses unpinned FROM python:3.13-slim and unpinned pip install. DONE so far: uv.lock in highway and highway-engine bumped certifi to 2026.10.19 (ships with the first CI-built image).