fix(security): update root Pillow dependency

[0xjohnnydev]

What users see

The repository's root Python lockfile resolves Pillow 12.2.0. GitHub Dependabot reports multiple security advisories for that version.

What changed

• Updated only the root uv.lock Pillow entry to 12.3.0, the patched version reported by the visible alerts.
• This focused draft covers root Pillow alerts fix(trajectory_saver): Fix trajectory turn increment and be consistent with the doc #900 through Add OpenTelemetry instrumentation for Four Golden Signals monitoring #905 and Enhancement: Add Unit Tests for Agent Loop Implementations #944 through feat(lume): add clipboard sync between host and VM via SSH #950.
• The separate Cua Bench and sandbox lock graphs remain outside this draft.

Validation

• uv lock --check passed.
• Confirmed the root lockfile resolves Pillow 12.3.0 with no older root Pillow resolution.
• git diff --check passed.

Definition of Done

• Every visible root Pillow alert is mapped to this focused draft.
• The root lock graph resolves outside the reported vulnerable range.
• A maintainer reviews and advances this draft; this automation will not merge or mark it ready.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

[0xjohnnydev]

Closing this draft because its root Pillow update is now included in draft #2719. #2719 updates both GitPython and Pillow in the single root Python lockfile and validates them together. Nothing was merged or marked ready.