chore(deps): bump aiohttp to 3.14.3 and cryptography to 50.0.0 for security fixes

[abrichr]

Summary

Resolves all four open Dependabot alerts on uv.lock (2 high, 2 moderate):

Package	Locked	Fixed	Advisory	Severity
aiohttp	3.14.1 → 3.14.3	3.14.3	GHSA-cq5v-8q36-5273 (CVE-2026-69244) — OOB heap read in C HTTP response parser	high
aiohttp	″	3.14.2	GHSA-mfx4-hv73-q22v (CVE-2026-69243) — request smuggling via WebSocket upgrade	moderate
aiohttp	″	3.14.2	GHSA-mq44-7p77-q5h7 (CVE-2026-59881) — WS client accepts non-negotiated compressed frames	moderate
cryptography	49.0.0 → 50.0.0	50.0.0	GHSA-g6cj-pr64-35w5 (CVE-2026-69247) — PKCS#7 EnvelopedData Bleichenbacher oracle	high

Reachability triage

• cryptography is a direct runtime dependency (cryptography>=42.0), so every install is exposed to the vulnerable version range. The vulnerable PKCS#7 EnvelopedData decryption API is not called anywhere in this repo — usage is Ed25519 sign/verify (qualification, eligibility artifacts), AES-GCM + Scrypt (openadapt_flow/crypto.py), and self-signed x509 generation (win_agent/tls.py) — so practical exploitability here was low. Bumped regardless.
• aiohttp is not a base runtime dependency. It enters only through the optional service-mlx extra: mlx-vlm → datasets → fsspec[http] → aiohttp. Installs of the base package never pull it; the lock now resolves the fixed version for extra installs.

Lockfile notes

• The large uv.lock diff is uv 0.11 rewriting the lock to format revision = 3. Resolved-version changes are exactly the two bumps above plus python-xlib removed — the current resolver prunes it as unreachable (it was a Linux-only transitive of pywinauto, which this project uses on Windows only). Verified by structured old-vs-new lock comparison.
• ci.yml untouched (SHA-pinned in public-artifacts.json); CI jobs install with pip and do not consume the lock. release.yml uses latest uv via setup-uv, which supports lock revision 3.
• scripts/check_release_consistency.py passes: version 1.31.0 synchronized across project, module, and lock.

Test plan

• uv sync --extra dev clean with the new lock
• Import smoke test of all cryptography-touching modules under cryptography 50.0.0
• pytest -k "crypto or tls or qualification or artifact or eligibility" — 562 passed, 6 skipped
• Full protected CI matrix on this PR

🤖 Generated with Claude Code