Stop trusting the compromised eMudhra CA certificates #4001

On 2026-10-20 it was disclosed that the private keys of eight eMudhra (emSign) intermediate CA certificates can be recovered from the public certificates (https://emudhra.we-have-a-problem.com). Anyone holding one of the keys can issue a certificate for any domain, and clients that trust "emSign ECC Root CA - G3", or Sectigo's "AAA Certificate Services" through its cross-signatures, will accept it. No exploitation has been reported.

The Public API trusts the affected roots in these places:

• certifi 2026.4.22 in uv.lock, which httpx uses for the Auth0 token request, the Auth0 Management API client, the simulation service client and Hugging Face downloads.
• The Debian ca-certificates package in the production Cloud Run image built on 2026-10-20, which PyJWT reads when it fetches Auth0's signing keys.
• The CA list bundled in grpcio 1.80.0, which the Google Cloud Logging, Secret Manager and OTLP export clients use. No grpcio release has removed the roots yet.
• uv 0.12.1, used during the Cloud Run image build and in two workflows.
• The observability collector image otelcol-google:0.160.0, which bundles both roots.

Done when:

• Stop trusting the compromised eMudhra CA certificates #3999 is merged.
• A release run rebuilds the Cloud Run image and deploys it to staging and production.
• The observability collector is redeployed with otelcol-google:0.163.1.
• Production is confirmed to serve the new revision (gcloud run services describe).