chore(core): drop the unused direct sha1 dependency (#5056)

[graycyrus]

Summary

• Remove the unused direct sha1 dependency from the core Cargo.toml.
• No behaviour change: sha1 has zero use-sites in this crate; it stays in Cargo.lock transitively for crates that do need it.

Problem

sha1 was declared as a direct dependency only for legacy Tencent COS HMAC-SHA1 signing (yuanbao channel media upload), which now lives in the tinychannels crate. It is the last zero-reference dependency from the #5056 cleanup audit — the OpenTelemetry trio, prost, postgres, ripemd, unicode-normalization, prometheus, dialoguer, clap_complete, and shellexpand were already removed upstream by #5052.

Solution

• Drop sha1 = "0.10" and its stale comment from [dependencies].
• Regenerate Cargo.lock (only the direct edge is removed; sha1 remains transitively).
• hmac is kept — still used by x402 / clob_auth / tinyplace (HMAC-SHA256 etc.).
• webpki-roots is intentionally not removed: it backs the rustls-tls-webpki-roots TLS feature (tokio-tungstenite) and is a load-bearing version pin despite having no direct code reference.

Verified zero use-sites: no sha1::, use sha1, Sha1, or Hmac<Sha1> anywhere in src/, tests/, or examples/.

Submission Checklist

• Tests added or updated — N/A: dependency-manifest change, no code paths added/removed.
• Diff coverage ≥ 80% — N/A: no executable lines changed.
• Coverage matrix updated — N/A: no feature change.
• All affected feature IDs listed under ## Related
• No new external network dependencies introduced (this removes one)
• Manual smoke checklist — N/A: build-only change.
• Linked issue — partial; see ## Related (does not close Remove unused/redundant features: screen intelligence, order complete, desktop automation, autocomplete, Whisper, unnecessary runtimes #5056).

Impact

• Runtime: none.
• Build: one fewer direct dependency edge. cargo check passes with media ON and the disabled gate.

Related

• Part of Remove unused/redundant features: screen intelligence, order complete, desktop automation, autocomplete, Whisper, unnecessary runtimes #5056 (does not close — one slice of a multi-part cleanup)
• Complements Remove zero-reference dependencies and unwired domains #5051 / chore(core): remove zero-reference deps and redirect_links domain #5052 (the bulk zero-ref dependency removal, already merged)
• Follow-up PR(s): remaining Remove unused/redundant features: screen intelligence, order complete, desktop automation, autocomplete, Whisper, unnecessary runtimes #5056 slices

---

AI Authored PR Metadata (required for Codex/Linear PRs)

Linear Issue

• Key: N/A
• URL: N/A

Commit & Branch

• Branch: fixes/rm-zero-ref-deps
• Commit SHA: 2b3d844

Validation Run

• pnpm --filter openhuman-app format:check — N/A (no app changes)
• pnpm typecheck — N/A (no TS changes)
• Focused tests: cargo check media ON + disabled gate both pass
• Rust fmt/check (if changed): no Rust source changed (manifest only)
• Tauri fmt/check (if changed): N/A

Behavior Changes

• Intended behavior change: none (removes an unused direct dependency edge)
• User-visible effect: none

Parity Contract

• Legacy behavior preserved: yes — sha1 had no use-sites; hmac + webpki-roots retained
• Guard/fallback/dispatch parity checks: N/A

Duplicate / Superseded PR Handling

• Duplicate PR(s): none (complements the already-merged chore(core): remove zero-reference deps and redirect_links domain #5052)
• Canonical PR: this
• Resolution: N/A

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a0a2cf9b-ade3-4034-abf8-c7e73e0fd4c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}