v1.9.3: fix reachable dependency vulnerabilities

Closes reachable dependency vulnerabilities and removes a race from the retry
test suite.

- Updated `golang.org/x/crypto` to v0.57.0, fixing the reachable SSH
  authorization and certificate validation vulnerabilities GO-2026-6354 and
  GO-2026-6355.
- Updated `github.com/moby/go-archive` to v0.3.3, fixing the reachable archive
  extraction vulnerability GO-2026-6253.
- Retry tests now synchronize cancellation to observed service runs instead of
  relying on wall-clock sleeps that could expire before the service goroutine
  started under load.