chore(deps): consolidate dependency updates and repair verification contracts #439

The dependency updates in PRs #395, #397, #398, #407, and #408 overlap the grouped Python update in #436. Retain #436 and the GitHub Actions update #437, close the redundant standalone PRs, and correct the retained updates before merging.

The updates belong within this repository's authoring, validation, release, and CI tooling remit. They must preserve the existing RAES semantic authority and exact upstream RAES pin.

Required corrections

• Update httpx2 and httpcore2 together in chore(deps): bump the ci-toolchain group across 1 directory with 22 updates #436. Upstream httpx2 requires the same exact httpcore2 version; the standalone PRs fix(deps): bump httpcore2 from 2.12.0 to 2.13.1 #395 and fix(deps): bump httpx2 from 2.12.0 to 2.13.1 #398 each leave an unresolvable pair.
• Regenerate all co-installed dependency locks together. In particular, idna must agree across requirements/runtime.txt and requirements/pip-audit.txt; fix(deps): bump idna from 3.19 to 3.20 #397 and chore(deps): bump the ci-toolchain group across 1 directory with 22 updates #436 currently update runtime without updating the audit lock. Check the other shared packages against the workflow-derived co-installation contract as well.
• Update the active SBOM generator in requirements/sbom.in and requirements/sbom.txt, while preserving cyclonedx-bom==7.3.0 in the historical v2.0.2 recovery input and lock. ADR 0026 requires the historical SBOM generator, and tests/test_dependency_pinning.py explicitly asserts that pin. Both fix(deps): bump cyclonedx-bom from 7.3.0 to 7.5.0 #408 and chore(deps): bump the ci-toolchain group across 1 directory with 22 updates #436 currently change it to 7.5.0. Preserve the recovery's historical runtime authority while retaining justified security fixes and the current build toolchain.
• Retain the sse-starlette update from fix(deps): bump sse-starlette from 3.4.11 to 3.5.0 #407 within chore(deps): bump the ci-toolchain group across 1 directory with 22 updates #436; its separate PR is redundant rather than rejected on technical merit.
• In chore(deps): bump the github-actions group with 5 updates #437, reconcile tests/test_release_workflow_tag_signing.py with the reviewed upload-artifact SHA update. Preserve full SHA pinning, existing least-privilege permissions, and the signed-tag recovery guarantees.
• Keep lock/toolchain-only updates under chore(deps), consistent with .github/dependabot.yml; do not change package metadata or trigger a release solely to update a CI lock.

Acceptance criteria

• chore(deps): bump the ci-toolchain group across 1 directory with 22 updates #436 contains a resolvable dependency closure, all co-installed locks agree, and the exact raes pin remains consistent with pyproject.toml.
• The recovery lock retains the historical cyclonedx-bom==7.3.0 contract; the active SBOM tool receives the reviewed update.
• chore(deps): bump the github-actions group with 5 updates #437's workflow and test expectations agree on the reviewed action SHA, with security and recovery invariants preserved.
• Required verification succeeds for the final heads of both retained PRs. Inspect failure logs and address all remaining failures rather than assuming the identified mismatches are exhaustive.
• Run the repository's documented unit, content, release, and compile checks for the corrected changes.

Corrections are pushed to #436 at 244fdb8 and #437 at 37ea26c. Each branch passes all 951 unit tests locally, both content-validation commands, both release checks, and compilation. All CI checks pass on both final heads, including tests, audit, content, docs, compilation, fuzzing, CodeQL, Sonar, the title guard, security checks, and the required verify gate. Both PRs remain open and mergeable; this issue remains open pending integration.

Superseded standalone PRs: #395, #397, #398, #407, #408. Retained implementation PRs: #436 and #437. This issue does not authorize merging either retained PR.