[scouten-adobe]

Changes in this pull request

Update the native SDK selector from c2pa-v0.91.6 to c2pa-v0.91.7. Normal wheel builds and developer downloads already consume c2pa-native-version.txt; source-build/preflight configuration is unchanged. Contributor setup now follows that selector instead of recommending 0.91.3.

Consolidate the complete package-version change from #352: bump c2pa-python from 0.38.2 to 0.38.3, so this PR includes the package bump alongside the native SDK and TLS trust-store updates. #352 contains no other changes; its version bump is now fully included here.

Require certifi>=2026.10.19 in both published runtime metadata and requirements-dev.txt, which is installed before the Requests-based artifact downloader. Upstream's bundle change removes the affected emSign ECC Root CA - G3. This independent Python trust path is not patched by replacing the Rust binary, nor can certifi patch an old binary.

Document deployment boundaries: urllib/OpenSSL default stores, OS/interpreter roots, custom CA overrides, and packaging tools need separate updates. No unrelated cryptography dependency removal, Python runtime migration, merge, or release is included. Existing installed wheels require replacement; this PR only changes future builds.

Validation on macOS ARM64 / Python 3.13.2:

• Downloaded the actual 0.91.7 release artifact using scripts/download_artifacts.py; its archive SHA-256 matches GitHub's published 8a0c828e41a5c8a81d83426085b4e4dfca66a7e7b3d8fee3f31089812e63b5fd.
• .venv/bin/python -m pytest tests/test_unit_tests.py tests/test_unit_tests_threaded.py -q --disable-warnings: 551 passed, 47 subtests passed (15 existing deprecation warnings), before the package-version-only consolidation.
• .venv/bin/python setup.py --quiet bdist_wheel --plat-name macosx_11_0_arm64: built and installed the wheel; checked that wheel metadata requires the certifi floor and its bundled dylib is byte-identical to the downloaded library. Import from an empty directory confirmed the installed package's own bundled dylib reports SDK 0.91.7.
• Rebuilt and installed the wheel after consolidating chore: Bump version from 0.38.2 to 0.38.3 #352; wheel metadata and an empty-directory import confirm Python package 0.38.3, native SDK 0.91.7, and the retained certifi>=2026.10.19 dependency.
• .venv/bin/python -m build --sdist --no-isolation --outdir .venv/sdist: source archive preserves the floor in pyproject/egg-info and contains no native binaries (before the package-version-only consolidation).
• Tested the exact minimum certifi==2026.10.19: all four authoritative roots.json fingerprints are absent; OpenSSL with only that CA bundle rejects all 14 supplied incident chains with a missing-trusted-issuer error, including AAA cross-signs and No-CT chains. This does not claim remediation for custom/OS stores.
• .venv/bin/python -m pip check, make -n download-native-artifacts PYTHON=.venv/bin/python, and git diff --check: passed.

Cross-platform build coverage remains for CI. Native SDK version and artifact identity were verified; native network-provider behavior was not inferred from dependency versions or Python's certifi results. See the public incident details and chains.

Checklist

• This PR represents a single feature, fix, or change.
• All applicable changes have been documented.
• Any TO DO items (or similar) have been entered as GitHub issues and the link to that issue has been included in a comment. (No new TODO items.)

[tmathern]

This should go in release notes...

[tmathern]

Please move the "why" of this fix in release notes.