chore(deps): aggregate envs Dependabot updates

[cursor]

Summary

Rebases yesterday's envs Dependabot rollup (#1146) onto current main so remaining lockfile security bumps can merge cleanly after #1114 (coding_env tornado) and #1116 (textarena nltk) landed.

No new individual Dependabot PRs opened overnight. This PR only carries unpublished envs/**/uv.lock updates from #1146 / #1015.

Included (still not on main):

• cryptography → 50.0.0 in calendar, carla, chat, opencode, pelican_svg, pi, qed_math, sophistry_bench_sprint, sumo_rl, terminus, websearch, agent_world_model, wildfire
• aiohttp → 3.14.3 in agent_world_model, finrl, openapp, qed_math, sophistry_bench_sprint
• h2 4.4.1 / hpack 4.2.0 in coding_tools_env
• nltk 3.10.0 in openapp_env
• pyjwt 2.13.0 in tbench2_env
• pillow 12.3.0 in websearch_env

Left untouched so we do not regress main:

• envs/coding_env (tornado 6.5.8 + Hugging Face registry already on main)
• envs/textarena_env (nltk>=3.10.3 already on main; chore(deps): aggregate envs Dependabot updates #1146 still had >=3.10.0)
• envs/repl_env (pypdf>=6.16.1 already on main)

This supersedes #1146 and #1015.

Core Dependabot status (no second mergeable PR today):

• No open Dependabot singles outside envs/.
• Doc-builder pins on main (cf20b09) are already newer than chore(deps): aggregate non-env dependabot updates #1109 (1b16dac). Opening a core PR from chore(deps): aggregate non-env dependabot updates #1109 would downgrade workflows.
• FastMCP 4 (#1119, pin >=3.0.0,<5.0.0) remains blocked: HTTP and WebSocket inc_counter persistence still fail. #1119 was closed 2026-09-10; do not re-open until those tests pass.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring
• Dependency updates (envs only)

Alignment Checklist

Before submitting, verify:

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated (envs lockfiles only; no agent-facing reset/API changes)
• uv lock --check passed in every updated env

RFC Status

• Not required (bug fix, docs, minor refactoring)
• RFC exists: #___
• RFC needed (will create before merge)

Test Plan

• git diff --check origin/main...HEAD
• Scope is envs/**/uv.lock only (17 files)
• uv lock --check in each updated environment: pass
• No src/ or root pyproject.toml changes

Claude Code Review

N/A — Dependabot lockfile rollup.

This automation cannot close PRs (GitHub token returns 403). Please close these superseded aggregates:

• chore(deps): aggregate envs Dependabot updates #1146 (yesterday's conflicting envs rollup)
• chore(deps): aggregate envs dependabot updates #1015 (older envs rollup)
• chore(deps): aggregate non-env dependabot updates #1109 (older core rollup; would downgrade doc-builder pins)