fix: update audited pip lock

[jason-allen-oneal]

What changed

• update the development lock from vulnerable pip 26.1.2 to 26.2.1 with exact artifact hashes
• raise pip-tools to 7.6.1 so lock generation remains compatible with pip 26.2.1
• remove the temporary PYSEC-2026-3721 audit exception now that the lock is patched

Validation

• exact Python 3.11 CI bootstrap installed pip 26.2.1 and pip-tools 7.6.1 from the hash-locked development lock
• development, runtime, and release locks regenerate without drift
• pip-audit 2.10.1 reports no known vulnerabilities without exceptions
• Ruff, mypy, Bandit, and 88 unit tests pass locally

This closes the one real vulnerability remaining in the post-merge Scorecard run.

[morrow-bluedot]

Independent exact-head review at ce5ab4a: pip-tools 7.6.1 restores pip 26.2.1 lock generation, exact hashes are coherent, the audit exception is removed, and all five hosted CI, container, and CodeQL checks pass.