[MattDHill]

Picks up forgejo-runner's refreshed guest image so job VMs no longer trust the distrusted eMudhra (emSign ECC Root CA - G3) root.

• Bumps the forgejo-runner-startos pin to d7501df, the merge of fix: stop trusting emudhra roots in the runner and job vms forgejo-runner-startos#26. The Dockerfile copies runtime/assets/ from it, so the guest image moves from Debian cloud trixie 20261015-2632 to 20261021-2638, which ships ca-certificates 20250419+deb13u1. Prepared guest images re-prepare because their fingerprint covers guest-images.json.
• The controller was already fixed; nothing else changes.
• Version 5.2.2:1. The release note uses the fleet wording in all five locales.

Helix: do not build or pack this package. No make, s9pk pack or docker build, locally or on a VM. GitHub CI builds it on this PR; review the diff and the CI result. Leave the checkout on the default branch.

🤖 Generated with Claude Code

[helix-a]

Approved; no correctness regressions found in 335ba17.

Verified clean merge into master and git diff --check. Compared the exact old/new dependency trees: the only shared-runtime change is runtime/assets/guest-images.json; the Dockerfile consumes those assets and the preparation fingerprint includes that manifest, invalidating existing prepared guests. Both architecture hashes match Debian's published SHA512SUMS, and both published image manifests list ca-certificates 20250419+deb13u1.

The package/lockfile pins agree, SDK 3.1.0 is current on npm, and beta serves 5.2.2:0, making 5.2.2:1 the next revision. Release notes cover all five locales; the outgoing migration is empty.

No build, pack, Docker build, or VM test run. CI matrix discovery passed; x86 and ARM builds were still running when inspected. Checkout restored to the default-branch tip; no source changes or pushes.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol