[WendellXY]

The latest main CI run at 4e089af452e4876e09d0143183b7e15992a1a56b fails in two independent gates:

• The no-default-features docs build rejects a public spawn documentation link to the private background module. Replace that link with the lifecycle explanation so public docs remain useful and build with -D warnings.
• cargo-deny rejects rustls-webpki 0.103.15 (RUSTSEC-2026-0382) and webpki-roots 1.0.9 (RUSTSEC-2026-0381). Update only those locked dependencies to patched versions 0.103.16 and 1.0.10.

Both failures were reproduced locally before the fixes. No tests, warning rules, advisory exceptions, feature gates, or CI checks changed.

Validation on reviewed head 0048c81886d6fba5f26b7bceccb7707394b1230b passed on macOS with CI's exact Rust 1.99.1:

• cargo fmt --all --check
• cargo check --workspace --all-targets --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-features --locked: 1,845 passed, zero failures
• RUSTDOCFLAGS='-D warnings' cargo doc -p basis --no-default-features --no-deps
• cargo check -p basis --no-default-features --all-targets --locked
• cargo test -p basis --no-default-features --locked: 1,078 passed, zero failures
• cargo +1.95.0 check --workspace --all-targets --all-features --locked
• cargo-deny 0.20.2, matching CI, with a fresh RustSec database: advisories, bans, licenses, and sources all pass

The workspace's three existing ignored entries are two subprocess helpers invoked by their parent tests and one documentation example; the no-default-feature suite has that same ignored documentation example. These remain unchanged. The full suites ran with loopback socket/process access after the sandbox blocked those operations in the initial attempt.

Only basis/src/tools/spawn.rs and Cargo.lock changed. Linux and Windows validation is left to the PR's CI matrix.