fix: address nspect vulnerability findings

[johnnygreco]

Summary

• promote audited Python transitive versions to explicit manifest floors and regenerate the affected uv lockfiles
• update React/React DOM to stable 19.2.8 and refresh the npm lockfile
• refresh the compatible Z3 0.19 Cargo graph and document the no-fix RustCrypto transitive finding
• preserve installability where scanner targets are unavailable on the supported platform

Key dependency updates

• transformers 5.15.1
• torch 2.13.0
• protobuf 7.36.0
• setuptools 84.0.0
• pip 26.2.1
• aiohttp 3.14.3
• starlette 1.6.0
• pillow 12.3.0
• mediapipe 0.10.35
• React and React DOM 19.2.8

Validation

• make check in projects/egress-gate: 324 tests passed; Ruff, formatting, ty, import check, and pip-audit passed with no known vulnerabilities
• Reachy uv lock --check and uv build: passed
• npm ci: zero vulnerabilities
• npm run build: passed
• all repository pyproject.toml files parse successfully
• cargo metadata --locked --no-deps: passed

Upstream exceptions

• GStreamer 1.29.2a0 cannot resolve for the macOS-targeted Reachy lock because its required gstreamer-python release has no macOS wheel. This uses the latest installable stable bundle, 1.28.6, and records the limitation in the manifests.
• The reported RustCrypto crates are build-only dependencies of Z3 0.19 and have no fixed release or scanner upgrade guidance. Z3 0.20 was evaluated but requires a newer glibc/libstdc++ baseline than Ubuntu 22.04. The compatible Z3 line remains documented.
• Rust tests could not complete on this host because bundled upstream Z3 currently requires C++ <format>, which is unavailable in the host GCC 11 standard library.