fix(security): patch sandbox app Pillow

[0xjohnnydev]

Problem

The sandbox app catalog's Python lockfile still resolves vulnerable cryptography and Pillow releases.

What changed

• Updated cryptography to 50.0.0.
• Kept Pillow at 12.3.0.
• This draft covers the current cryptography alert Add 'openclaw' to examples pages #1098 and the earlier sandbox-apps Pillow alerts.
• The root, Cua Bench, and cua-sandbox lock graphs remain separate.

Definition of Done

• The current sandbox-apps cryptography alert is mapped to this focused draft.
• The lockfile resolves cryptography 50.0.0 and Pillow 12.3.0.
• The lockfile passes uv consistency validation.
• A maintainer reviews and advances this draft; automation will not mark it ready or merge it.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

Validation

• uv lock --upgrade-package cryptography==50.0.0 --upgrade-package Pillow==12.3.0 in libs/python/cua-sandbox-apps.
• uv lock --check.
• git diff --check.

Impact

This changes only the sandbox app dependency lockfile. No VM, installation, or live runtime proof was run on the host.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[0xjohnnydev]

This draft is now included in the consolidated Python security draft #2719. #2719 contains the sandbox-apps lockfile fix together with the matching root, Cua Bench, and sandbox Python updates, checks each lock graph separately, and remains a draft for human review. Closing this copy reduces duplicate review; nothing was merged automatically.