fix(deps): upgrade pyjwt to 2.15.1 and urllib3 to 2.8.0 for published advisories

[Brad-Edwards]

Summary

dev fails the supply-chain osv-scan gate, which blocks the dev → main PR #1402. Two locked dependencies in implementations/python/uv.lock carry published advisories:

• pyjwt 2.14.0: GHSA-42vr-xj54-vc7v, fixed in 2.15.0. fix: republish research evidence for the merged control-plane boundary source #1404's branch upgraded to 2.15.1 in 7c57e70c, but a later Merge origin/dev resolution (2f09a2b9) took dev's lockfile and dropped the upgrade.
• urllib3 2.7.0: GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, GHSA-vxq7-64xx-v4gw, all fixed in 2.8.0.

This PR upgrades both packages. The research-evidence captures hash the lockfile, so both are republished.

Requirement UIDs

• None. This is a dependency security upgrade with no requirement scope.

Related Issues

No issue: remediates a supply-chain gate failure on dev found while checking #1402.

ADR Impact

• None.

Changes

• uv.lock: pyjwt 2.14.0 → 2.15.1 and urllib3 2.7.0 → 2.8.0. No other resolution changes.
• Hash-complete smoke closures and wheelhouse manifests regenerated for all six targets with python -m tools.generate_python_closures.
• Specification-coverage release 65.0.0 and formal-validation release 66.0.0 (baseline 65.0.0) are cut against the upgraded lock.
• Participant-crossing model bundle crossing-models/rev2/manifest.json rebound to the new lock digest (its source_digests include uv.lock). The model artifacts are byte-identical; the same in-place rebind as efffbe55.
• Revision pins advanced in tools/check_specification_coverage.py, tools/formal_semantic_validation/, and the three evidence test modules. Both research indexes now record the new releases.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

nox -s osv_scan passes (it failed on dev at 44a0fd9f). Both evidence checker CLIs pass integrity and replay. The evidence and tooling-policy modules pass with integration included (321 passed), and so do the crossing-export and repository-governance modules (584 passed together). nox -s verify-fast-feedback --base-rev origin/dev passes, and so does tools/check_tooling_artifact_policy.py.

Ground Control Checks

• Tooling artifact policy passes with the regenerated closures
• Research-evidence source state binds the upgraded lock (implementation_digest matches the live tree)

Traceability

• Supply-chain failure on dev: CI run 36781383450, job supply-chain
• Dropped upgrade: 7c57e70c (upgrade) and 2f09a2b9 (merge that reverted it)

Checklist

• No security gate weakened; the advisories are fixed by upgrading
• Captures generated after the last source edit