Landed directly on main rather than through a PR, so the image-pins
tripwire (pull_request-only) does not turn this bump's one uv.lock line
into a sandbox rebuild.

The skip is provably empty: `git diff v0.37.6..HEAD` is the website's
index.html and two files under tests/hub/web, plus this commit's
pyproject version and the matching uv.lock line. No arena input moved --
nle-base/Dockerfile, arena/Dockerfile, Dockerfile.mutator,
src/nethackers/arena/ and src/nethackers/contracts/ are all byte-identical
to v0.37.6, and the tripwire itself ran on PR #115 and passed. Arena stays
pinned to its existing image; no new verified epoch.

Web/hub-only, so this tags and deploys the hub but gets no GitHub release
-- the CLI is unchanged and PyPI stays at 0.37.6.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>