chore: update-project.sh ⇄ phaze parity (floor-sync, cap-flag, full action SHA-pinning)

[SimplicityGuy]

Summary

Brings scripts/update-project.sh in line with phaze's enhanced updater
(phaze #71, now merged), adapted to
discogsography's shape: a uv workspace (root pyproject.toml + 11 member packages,
single root uv.lock), a Rust extractor, and a Node frontend. All existing
Rust/Node/multi-service/security-sweep behavior is preserved.

Parity note: sync_dependency_floors() and flag_capped_dependencies() did not
exist in the shared lineage of these two scripts until phaze added them in #71.
discogsography's updater lacked them; this PR adds the monorepo-adapted equivalents,
bringing the two scripts back into parity. They are intentional new capabilities, not a
regression.

New capabilities

1. sync_dependency_floors() — runs right after the lock+sync step. uv lock --upgrade
refreshes uv.lock within the existing >= floors but never raises the floors themselves
(the job Dependabot otherwise opens PRs for). This raises the floors in pyproject.toml to
match what's actually locked.

• Monorepo adaptation: iterates every pyproject.toml (root + all 11 members) and
  resolves each against the single root uv.lock.
• Covers [project.dependencies], every [project.optional-dependencies].* sub-array, and
  every [dependency-groups].* array.
• Rewrites only the >= floor token — caps (,<X), extras (pkg[redis]), env markers
  (; sys_platform ...) and trailing inline comments are preserved.
• Inline uv run python heredoc (tomllib + packaging), not a tracked .py
  (scripts/ is type/lint-checked). Re-runs uv lock afterward so recorded requirement
  metadata matches. Honors --dry-run; prints one BUMPED <file>: <pkg> <old> -> <new>
  line per change (file-qualified for monorepo clarity).

2. flag_capped_dependencies() — warns when a ,<X-capped dependency has a release at or
beyond the cap (uv can't cross a cap; raising it is a human decision). Cross-references
uv pip list --outdated, parses caps from all pyproject.toml files, compares with
packaging.version, and skips the workspace's own packages. Honors --dry-run.
(discogsography currently has no capped deps, so this reports none — it's future-proofing.)

Parity audit (items 3–6)

3. GitHub Actions SHA-pinning — every uses: in .github/workflows/ and
   .github/actions/ is now owner/repo@<40-char-sha> # vX.Y.Z. 18 floating actions
   resolved to SHAs; the 8 pre-existing pins normalized to the two-space comment style;
   create-pull-request comment fixed (# v.8.1.1 → # v8.1.1).
   dtolnay/rust-toolchain@stable and taiki-e/install-action@cargo-llvm-cov are pinned
   with explicit toolchain: stable / tool: cargo-llvm-cov to preserve behavior after
   losing the channel/tool shorthand. update_uv_version() now also scans .github/actions/
   (setup-uv lives in the composite action here, not the workflows) and pins it the same way.
4. Dockerfiles — every apt-get install already carries a # hadolint ignore=DL3008
   pragma; confirmed hadolint is clean for all 11 Dockerfiles.
5. Pre-commit — confirmed hadolint runs in .pre-commit-config.yaml, every hook rev:
   has a # frozen: vX.Y.Z comment, and shfmt covers scripts/update-project.sh.
6. update_docker_images() — new function surfaces the full Docker dependency surface
   (all FROM base images incl. node/rust/debian, the uv image, and compose service images
   like postgres/neo4j/rabbitmq/redis), noting Dependabot-managed vs distro-managed (apt).

Comment-spacing convention

The task spec mandated two spaces before #. This repo's .yamllint only requires
min-spaces-from-content: 1 (so one space passes here — the "or yamllint fails" rule is
phaze's), and the 8 existing pins used one space. Per maintainer direction, all entries —
new and existing — are standardized to two spaces, and the script writes setup-uv pins
the same way. Heads-up: Dependabot writes one space, so it may re-introduce drift on future
action bumps.

Validation

• shellcheck --severity=warning — clean
• shfmt (repo args) — clean
• ./scripts/update-project.sh --dry-run — exits 0, exercises every section, writes nothing
• pre-commit run --all-files — 29/29 hooks pass
• Floor-sync write path tested in isolation: caps/extras/markers/inline comments preserved,
  no-op when locked == floor (dry-run reports 91 proposed floor bumps across the workspace)
• Cap-flag tested with synthetic --outdated data (flags correctly) and against the real
  workspace (reports none)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

E2E Coverage (webkit)

Totals
Statements:	46.5% ( 1241 / 2669 )
Lines:	46.5% ( 1241 / 2669 )

[github-actions]

E2E Coverage (chromium)

Totals
Statements:	46.5% ( 1241 / 2669 )
Lines:	46.5% ( 1241 / 2669 )

[github-actions]

E2E Coverage (firefox)

Totals
Statements:	46.5% ( 1241 / 2669 )
Lines:	46.5% ( 1241 / 2669 )

[github-actions]

E2E Coverage (webkit - iPhone 15)

Totals
Statements:	46.5% ( 1241 / 2669 )
Lines:	46.5% ( 1241 / 2669 )

[github-actions]

E2E Coverage (webkit - iPad Pro 11)

Totals
Statements:	46.5% ( 1241 / 2669 )
Lines:	46.5% ( 1241 / 2669 )