max / makenotwork

server: bump authenticode to 0.6 and object to 0.39 These two move together: authenticode 0.6.0 requires object ^0.39.0, which is why the standalone object bump was blocked and had to fold in here. 1890 lib + 1190 integration green, clippy clean. x509-cert 0.3.0 and const-oid 0.10.2 are NOT in this commit and are not actually available yet. The task assumed the four move as one unit; that is wrong on the facts. authenticode 0.6.0 still depends on x509-cert ^0.2.0 and const-oid ^0.9.0, so raising ours puts two x509_cert versions in the graph and the certificates handed back by sig.certificates() stop matching extract_subject_cn's signature. Tried it, reverted it. Those two now wait on authenticode, not the other way round. Verified the code-signing paths rather than the bump alone, since the authenticode API is what parses PE signatures: all 10 signing_windows tests pass (PE structure detection, signer extraction, the fail-open path, and malformed input), plus the linux and macos signing suites, 249 scanning tests in total.