chore: update all dependencies and correct stale provider floors

[rasros]

uv lock --upgrade across the board, plus two dependency floors that turned out to be wrong.

Five major-version bumps, two of which touch code directly, so I verified those rather than trusting the test suite alone.

rich 14.3.3 → 15.0.0 drives the whole dashboard. Rendered it with all four stop criteria enabled and confirmed the output is intact. Note that rich 15 drops rich.__version__; the codebase never used it, only my probe did.

google-genai 1.69.0 → 2.14.0 is a major bump under the Gemini provider. Checked every symbol it touches: genai.Client(api_key=), types.Part.from_bytes, and the temperature, thinking_config, response_mime_type and response_schema fields of GenerateContentConfig, plus ThinkingConfig.thinking_budget. All present.

Also checked the other two providers, since anthropic 0.86 → 0.120 and openai 2.30 → 2.49 are large jumps: every keyword argument the code passes to messages.create and chat.completions.create still exists.

The remaining majors are cryptography 46→49, setuptools 81→83 and pyrefly 0.58→1.1, none of which the package imports.

472 tests pass with zero skips. That matters here: torch and transformers were not installed locally before, so the 13 vision tests had been skipping. Installing the vision extra exercises torch 2.11 → 2.13 and transformers 5.4 → 5.14 against the real scorer. I also ran an end-to-end offline search for all three formats (svg 0.0039, graphviz 0.1394, typst 0.0938) and both analysis scripts under matplotlib 3.11.

The two floor corrections are bug fixes, not a narrowing of support. anthropic>=0.21.0 and openai>=1.0.0 cannot run this code at all. Verified by installing those exact versions: neither supports the parameter the --reasoning feature passes.

anthropic==0.46.0  thinking=no          openai==1.55.0  reasoning_effort=no
anthropic==0.47.0  thinking=yes         openai==1.60.0  reasoning_effort=yes

So the floors move to anthropic>=0.47.0 and openai>=1.60.0, which is where those parameters actually appear. Bisected rather than guessed. Left every other floor alone, since the code runs on both sides of each.

Two things worth knowing, neither caused by this PR and neither gating:

pyrefly goes from 21 errors to 23. It is not in CI and was already unclean, so this is not a regression, but the two new findings do come from the upgraded SDK stubs: chat.completions.create and messages.create are now typed as returning a union with Stream, and pyrefly narrows to the streaming branch. Neither call passes stream=True, so both are false positives at runtime. Happy to silence them separately.

While probing the old floors I found that anthropic==0.21.0 and openai==1.0.0 also cannot construct a client against a modern httpx at all, since it removed the proxies argument they pass. Independent of the parameter problem, and further reason those floors were stale.