chore(deps): refresh locked dependencies and setup-uv

[megabyde]

Manual sweep of upstream releases since #239/#240, covering the three bumps Dependabot cannot reach on its own plus the routine lock refresh.

sherpa-onnx 1.13.4 -> 1.13.6

The reason this PR exists. 1.13.6 exposes window_shift_ratio on OfflineSpeakerSegmentationPyannoteModelConfig in the Python binding (k2-fsa/sherpa-onnx#3870); it was CLI-only before. Verified against the installed wheel:

__init__(self, model: str, window_shift_ratio: SupportsFloat = 0.1) -> None

The exact twin pins block Dependabot here, so they move by hand. No call site sets the knob yet, so segmentation behavior is unchanged. Benchmarked on 300 s of audio at 4 threads with the cached pyannote/titanet models:

ratio	wall clock	RTF
0.1 (default)	20.96 s	0.070
0.2	10.62 s	0.035
0.3	7.32 s	0.024

Cost is inverse-linear in the ratio, so this is the largest lever on diarization wall clock. Tuning is deferred: the bench input was built by tiling a 3 s fixture, which measures cost correctly but says nothing about boundary accuracy. That needs real multi-speaker audio.

1.13.5 is nemotron/QNN/Android work and does not touch this project.

rich ceiling <15.0.0 -> <16.0.0

rich 15.0.0's only breaking change is dropping Python 3.8, which is far below requires-python = ">=3.12"; the rest is four bug fixes. The ceiling was ours and stricter than it needed to be.

Inert for now: instructor 1.15.4 caps rich<15.0.0, so the lock still resolves 14.3.4. Removing our own redundant ceiling means the bump lands via Dependabot once instructor relaxes, with no second manual edit.

setup-uv v9.0.0 -> v10.0.1

v10's breaking change disables caching by default on pull_request_target, workflow_run, and release events (cache-poisoning hardening, astral-sh/setup-uv#984). ci.yml and release.yml trigger on push, pull_request, tag push, and workflow_dispatch, none of which are affected, so caching behavior is unchanged.

Lock and floors

uv lock --upgrade moved 27 packages, including av 18.1.0, numpy 2.5.2, instructor 1.15.4 (fixes list[Model] response models crashing on model_json_schema), openai 2.54.0, ruff 0.16.4, ty 0.0.74, and pywhispercpp 1.5.1 (a CUDA 13.3 build fix, irrelevant to the macOS/CPU path). Declared floors were raised to match what resolves, following the versioning-strategy: increase the Dependabot config already uses.

ty jumped five pre-1.0 releases and ruff three patch releases with no new diagnostics against this tree.

Deliberately excluded

anthropic 1.0.0 shipped 2026-08-20 with the httpx2 migration. instructor 1.15.4 pins anthropic==0.93.0 exactly, so it is unreachable and should not be forced. Revisit when instructor moves.

Verification

make check passes: mdformat, pymarkdown, ruff format, ruff check, ty, and 323 tests at 100% coverage.