SECURITY UPDATE: out-of-bounds write via bz2 stream reuse after a
decompression error (CVE-2026-9669)
debian/patches/CVE-2026-9669.patch: record the libbz2 error code on the
BZ2Decompressor and BZ2File objects in Modules/bz2module.c and refuse
every later decompress() or read() call, so BZ2_bzDecompress() is never
re-entered on a stream libbz2 has already reported an error for; adds
regression tests for both paths to Lib/test/test_bz2.py