security: require setuptools 83

[ernestprovo23]

Summary

• add a development dependency floor of setuptools>=83.0.0
• regenerate requirements-dev.lock with workflow-pinned uv 0.6.16
• ensure the hash-locked CI environment installs audited setuptools==83.0.0

Root cause

The deps-locked job created a clean environment whose seed setuptools 79.0.1 was not represented in requirements-dev.lock. The fail-closed pip-audit gate therefore detected PYSEC-2026-3447, which is fixed in setuptools 83.0.0.

Validation

• lock regeneration/body comparison — exact match
• direct pip-audit -r requirements-dev.lock — no known vulnerabilities
• upgraded Python 3.11 audit environment — no known vulnerabilities
• full test suite — 604 passed, 2 skipped
• git diff --check — passed
• gitleaks git --no-banner --redact — 60 commits scanned, no leaks

Platform note

The complete local --require-hashes install is not reproducible on this Intel mac because cryptography 49.0.0 lacks a compatible wheel and its PyO3 source build fails with the local Rust toolchain. The Linux deps-locked GitHub Actions job is authoritative for that exact install path.