chore: bump Bamboo submodule pointer

[bigduu]

Summary

• advance the Bamboo submodule pin from 164ffd9c32bca7a056f23b901c19f03f8d90158e to f8eff2ef399eadda9fd9ac515cd5ec90fc09afc4
• publish the already-reviewed and merged Bamboo graceful-drain fix, dependency audit cleanup, and hermetic real SSH/SFTP transport contract through the Zenith wrapper
• keep the root diff limited to the single Bamboo mode-160000 gitlink

Submodule Updates

• bamboo: 164ffd9c32bca7a056f23b901c19f03f8d90158e → f8eff2ef399eadda9fd9ac515cd5ec90fc09afc4
  • includes Bamboo #855: preserve HTTP/1 graceful drain after the Actix dependency update
  • includes Bamboo #856: clear the remaining dependency audit warnings without exemptions
  • includes Bamboo #857: automate the real SSH/SFTP transport compatibility contract and fix the shutdown defects it exposed

The new Bamboo pin is a strict descendant of the old pin (merge-base == old pin, ahead 8 commits, behind 0).

Test Plan

• verify git diff-tree --raw contains only :160000 160000 ... M bamboo
• verify git merge-base <old> <new> equals the old Bamboo pin
• verify the Bamboo submodule checkout is clean and exactly at f8eff2ef399eadda9fd9ac515cd5ec90fc09afc4
• run git diff --check
• require the Zenith Submodule Guard workflow to pass

Screenshots

Not applicable (submodule pointer update only).

[bigduu]

Independent agent review completed at exact head 9c5f1d335cc2cdb8e3e4fdf2ef311c499554c2ec: APPROVE — no P0/P1/P2 findings.

Verified the 17-entry root trees directly: the only changed entry is the bamboo mode-160000 gitlink, 164ffd9c32bca7a056f23b901c19f03f8d90158e → f8eff2ef399eadda9fd9ac515cd5ec90fc09afc4; every other root blob/tree/gitlink is identical. The new Bamboo pin is ahead 8, behind 0, has the old pin as merge-base, is the live current Bamboo dev, and is PR #857's merge commit. The ## Submodule Updates notes are accurate, both Submodule Guard jobs are green, and there are no review threads. GitHub prevents the PR author's account from formally self-approving, so this records the independent agent verdict and reviewed SHA.