build(deps): refresh dev, build-backend and publish locks; uv 0.13.1, pydantic 2.14.1

[pengfei-threemoonslab]

Summary

Supersedes Dependabot #1087 (python-dependencies group, 24 updates) and #1085 (uv 0.12.9 → 0.13.1). Neither could merge as-is:

• Build(deps): Bump the python-dependencies group across 1 directory with 24 updates #1087 failed every job at install: it raised pydantic to 2.14.1 but left pydantic-core==2.46.5, which pydantic pins exactly (2.14.1 needs 2.50.1; Dependabot ignores pydantic-core).
• Build(deps): Bump uv from 0.12.9 to 0.13.1 #1085 bumped uv in release-publish.in without recompiling (verify_dependency_lock.py: "compiled with uv==0.12.9"), and its rewrite dropped the PyPy environment markers and wrote pydantic[email]==, which the lock verifier cannot parse.

Left out: #1086 (claude-agent-sdk harness floor). harness/requirements.txt asks for a smoke run plus a paid Sonnet cell before the floor moves.

What moved

Each lock #1087/#1085 touched is recompiled with uv 0.13.1, now pinned in constraints/release-publish.in. release-seal.txt is untouched. A recompile reproduces all three locks byte for byte (scripts/update_locks.py --uv <uv 0.13.1> constraints/dev.txt constraints/build-backend.txt constraints/release-publish.txt). Environment-marker lines are unchanged (dev 11, release-publish 2) and no extras-qualified pin appears.

• constraints/dev.txt: chardet 5.2.0 → 7.7.0, charset-normalizer 3.5.2, coverage 7.16.2, cryptography 50.0.2, cyclonedx-bom 7.5.0, dnspython 2.9.0, filelock 4.2.2, fqdn 1.6.0, hypothesis 6.170.1, idna 3.20, iniconfig 2.3.1, jsonpointer 3.2.1, more-itertools 11.2.1, platformdirs 4.13.4, pluggy 1.7.0, pycparser 3.11, pydantic 2.14.1 / pydantic-core 2.50.1, pyjwt 2.15.1, pyparsing 3.3.3, rpds-py 2026.9.1, ruff 0.17.1, tomli 2.5.0, typer 0.27.3, tzdata 2026.5, urllib3 2.8.0. A recompile re-resolves the whole closure, so a few pins land newer than Dependabot proposed (hypothesis, filelock, platformdirs, ruff).
• constraints/build-backend.txt: pluggy 1.7.0, tomlkit 0.15.2, trove-classifiers 2026.9.21.13.
• constraints/release-publish.txt: uv 0.13.1, charset-normalizer 3.5.2, cryptography 50.0.2, dnspython 2.9.0, idna 3.20, platformdirs 4.13.4, pycparser 3.11, pydantic 2.14.1 / pydantic-core 2.50.1, pyjwt 2.15.1, tuf 7.0.1, urllib3 2.8.0.
• chardet moves a major version because cyclonedx-bom 7.5.0 now admits chardet!=6.*,<8. It is dev-only, pulled in through cyclonedx-bom. The .github/dependabot.yml comment on the chardet ignore rule now describes that cap.

Published schema effect (owner-approved)

pydantic 2.14 carries an enclosing model's extra="forbid" into the JSON Schema of a stdlib dataclass it contains. CapabilityDiffRow therefore gains "additionalProperties": false in docs/verifier-schema.v0.21.json and docs/agent-boundary-result-schema.v3.json. The model already rejected unknown row keys under 2.13, so validation is unchanged. No emitted artifact, schema version or contract version moves, no test or doc pins either file's digest, and neither file is in FROZEN_CONTROL_SCHEMAS. Recorded in CHANGELOG.md.

Validation

• python scripts/verify_dependency_lock.py: OK for all four locks.
• Scratch venv installed from the new constraints/dev.txt with --require-hashes; ruff check . (ruff 0.17.1): clean.
• Full suite in that venv (pydantic 2.14.1): 23,157 passed. The 5 failures were the 3 schema round-trip tests, fixed by the schema regeneration above, and 2 test_check_unmodelled_host_config_keys.py[local_settings_*] cases. Those 2 come from this machine's global gitignore and pass with an empty XDG_CONFIG_HOME.
• After the regeneration and the rebase onto main (including fix(checks): publish secret and injection findings, widen redaction #1077), these pass under pydantic 2.14.1: schema round-trip, frozen control schemas, and every test reading the two schema files. So do privacy/documentation-check tests, the distribution-surface parity test, static-only lint and release-pipeline tests, plus scripts/regenerate_goldens.py --check (24 artifacts, 0 changed).

🤖 Generated with Claude Code