[rhenium]

Wrap everything in a big rb_protect() to simplify error handling and cleanup. This also fixes potential issues:

• Missing error check of TS_RESP_CTX_set_signer_key()
• Missing error check of TS_RESP_CTX_set_certs()
• Missing error check of TS_RESP_CTX_set_def_policy()
• Memory leak when rb_ary_new_capa() raises an exception

[Copilot]

🟡 Changes recommended

The new validation paths use rb_raise, leaving TimestampError#errors nil and OpenSSL errors queued, which can break existing error handlers.

1 open issue

• Use ossl_raise to preserve error details and clear OpenSSL queue · New

What changed in this PR

Refactors OpenSSL::Timestamp::Factory#create_timestamp to simplify exception handling and native-resource cleanup during timestamp generation.

Changes:

• Consolidates response creation under one rb_protect call with centralized cleanup.
• Adds error checks for signer-key, certificate-stack, and default-policy setters.

File	Description
ext/​openssl/​ossl_ts.c	Introduces shared creation state and a protected helper, updates callbacks, and centralizes resource cleanup.

_{Review effort: Max}