chore(security): resolve dependency-related CVEs

[inFocus7]

note: upgrade, lint, and unit tests failing. I notice these failures in other PRs, so failures are unrelated to my changes.

Context

• Resolving CVEs.
  • Removed unused pip that led to CVEs being caught for its existence (by Trivy, at least) -- I made a similar change in agentevals chore(security): target dependency lock for CVE fixes agentevals-dev/agentevals#182
  • Set a minimum for idna
  • Bumped UV_VERSION
• Set up a uv freeze + uv check to lint for python dependency management safety (ensuring version are based off the uv lockfile instead of bumped each time, possibly adding CVEs)

backend

	Before	After	Fixes
CPython (via UV_VERSION 0.11.15 → 0.12.3)	3.13.9	3.13.15	CVE-2026-3298, CVE-2026-4786, CVE-2026-6100, CVE-2026-7210, CVE-2026-9669, CVE-2026-1502, CVE-2026-3276, CVE-2026-6019, CVE-2026-7774, CVE-2026-8328
pip (bundled w/ interpreter)	26.1.x	removed from image	CVE-2026-8643, GHSA-6v7p-g79w-8964, CVE-2025-47273, CVE-2026-59890
idna	3.10	3.18	CVE-2026-45409

ui (no changes here, needs a rebuild of image to bump deps [on-release])

Summary

app image scan

	C	H	M	Total
main	1	10	15	26
PR	1	5	8	14

golang-adk clean, skills-init has 4 unresolvable CVEs (Alpine busybox/nghttp2)

Remaining CVEs (15)

backend

• CPython (8): CVE-2026-11940, CVE-2026-11972, CVE-2026-15308 (high); CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-12003 — fixes exist only in the 3.15 line. Requires python bump 3.13 -> 3.15 (or waiting to see if they get back-ported to 3.13.x).
  • I'll re-verify this post-merge, there have been some recent python cve fixes I believe were backported at least down to 3.14, unsure about 3.13.
• Debian 12 base (6): glibc CVE-2026-5450, CVE-2026-5435, CVE-2026-5928, CVE-2026-6238, CVE-2026-6791, libssl3 CVE-2026-42767 — no fix shipped in bookworm image, will investigate migrating to chainguard in follow-ups.

ui

• CVE-2026-54876 — openssl/libssl3/libcrypto3, no wolfi patch published yet. the floating wolfi-base:latest will pick it up automatically on the first rebuild after wolfi ships it, so no need for updates here.