fix(security): update Torch to 2.13.0

[0xjohnnydev]

Summary

Update Torch and TorchVision to versions that contain the security fix. No application behavior changes are intended.

Why

Dependabot reports GHSA-rrmf-rvhw-rf47 in the root and CUA Bench lock files. Torch 2.13.0 contains the fix.

What changed

• Require Torch 2.13.0 or later.
• Require the matching TorchVision 0.28.0 or later.
• Regenerate both affected uv lock files.

Definition of Done

• Both affected lock files select Torch 2.13.0.
• Both project files prevent resolution to the affected Torch versions.
• Both lock files pass uv lock --check.
• GitHub Actions pass on this pull request.

Test plan

• uv lock --check
• cd libs/cua-bench && uv lock --check
• Build the CUA SOM and CUA Bench Python packages.

[github-actions]

📦 Publishable packages changed

• pypi/bench
• pypi/som

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[0xjohnnydev]

Superseded by #2719. The patched setuptools floor cannot resolve with Torch 2.12.1, so the current dependency rollup carries this PR's exact Torch 2.13.0 / TorchVision 0.28.0 floors together with the rest of the Python graph. The salvaged work remains credited to @0xjohnnydev there.