Upgrade tracing-subscriber to prevent ANSI log injection #1688

Audit reference: I44

What can go wrong

The pinned tracing-subscriber version allowed user-controlled ANSI escape sequences to alter how retained logs were displayed.

When it happens

An unsafe sequence can arrive in any remote or structured value that is eventually formatted by the telemetry subscriber.

What changed

The workspace and support manifest now use tracing-subscriber 0.3.20.

Why the change works

The patched formatter prevents embedded terminal control data from being interpreted as trusted log formatting.

Checks

Logger redaction/formatting tests and crypto tracing consumers pass.