chore(deps): move the CI Python tools off a vulnerable starlette

[kkdev92]

Raises PlatformIO and regenerates the hash-pinned lock, which takes starlette
out of the resolved set at a version carrying published advisories.

platformio   6.1.19 -> 6.2.0
starlette    0.52.1 -> 1.6.0   (transitive, via PlatformIO)

Why this is possible now

PlatformIO 6.1.19 required starlette >=0.19,<0.53, so every fixed starlette
was outside the range it would accept and there was nothing to move to. That
is why the note in requirements-ci.in recorded the advisories as knowingly
present and unreachable rather than dismissing them.

PlatformIO 6.2.0 relaxes that to starlette <2. The resolver now reaches
1.6.0, which has no known advisories, so the note has been removed rather than
reworded -- there is no longer anything for it to explain.

Two other entries move as a consequence: PlatformIO relaxed marshmallow==3.*
to <5,>=3, marshmallow 4 no longer depends on packaging, and so
packaging leaves the closure entirely.

The regenerate command needed a caveat

uv pip compile keeps whatever an existing output file already pins unless
--upgrade is passed. Bumping PlatformIO and regenerating without it produced
a lock where the direct requirement had moved and starlette had not, which
reads as a successful regenerate. The header now says so.

What is deliberately not updated

espressif32 (7.0.1) and the m5gfx component (0.2.26) both have newer
releases. They decide the toolchain and the display driver, so they are
verified on a board rather than in CI, and are left for that.

Why the CodeQL pin changes shape

Its trailing comment named the CodeQL bundle version, codeql-bundle-v2.26.2,
rather than the action's own version. The pinned commit carries no
semantic-version tag, only that bundle tag, so Dependabot cannot derive a
current version for the pin and has never proposed an update for it. The pin
now points at the commit tagged v4.38.1, moving the action from 4.37.4.

Verification

The lock resolves to 28 packages, every one hash-pinned, and regenerating
without --upgrade reproduces it byte for byte. typing-extensions is
present, which is the entry that goes missing when the resolve is run for the
wrong interpreter and platform. Querying OSV for the resolved starlette
reports no known vulnerabilities, against ten for the version it replaces.
PlatformIO 6.2.0 parses this project's configuration, including the custom
boards directory and the extra CMake arguments.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code