chore(deps): close dependency and security backlog

[las7]

Summary

• refresh the lockfile past all 28 currently reported Dependabot advisories
• update GitHub Actions to the already-tested open Dependabot versions
• update Ruff to 0.16.1 across pyproject, pre-commit, lockfile, and CI
• scope Ruff CI to Python source, matching CLAUDE.md and avoiding unintended Markdown code-block rewrites
• keep the runtime image on a Python major covered by the test matrix

Security updates

• GitPython 3.1.50 -> 3.1.58
• Pillow 12.2.0 -> 12.3.0
• PyMdown Extensions 10.21.3 -> 11.0.1
• Starlette 1.2.1 -> 1.4.1

Validation

• ruff check tako_vm/ tests/
• ruff format --check tako_vm/ tests/
• uv lock --check
• YAML parse check for Dependabot and workflow files
• git diff --check

Full pytest execution is delegated to CI because the checkout host is at 100% disk utilization.