ci: drop redundant release test run + patch bart26g Dependabot vulns

[bartzbeielstein]

Context

Follow-up to #83. Two issues surfaced right after that merge:

1. Redundant test runs. Merging a PR to main triggered the Release workflow, which re-ran the fast test suite that the PR's CI check had just run. Two parallel runs testing the same code on the same commit — wasted minutes on the publish path with no added signal.
2. 18 open Dependabot alerts on the default branch (11 high, 7 moderate).

1. Reduce CI/Release redundancy (release.yml)

Why it's safe to remove: tests are already gated on every PR by ci.yml (the required fast check) and run in full nightly. The Release pipeline only runs on push to main, i.e. after a PR merged green — so re-testing the merge commit duplicated work. release.yml now publishes and deploys docs without re-testing.

Assumption: main is updated only via PRs (so the required CI check always runs first). If direct pushes to main are expected, keep branch protection's required Tests (fast) check enabled.

2. Patch Dependabot vulnerabilities (bart26g/uv.lock)

All 18 alerts were in the bart26g/ paper subproject lockfile (a Quarto/arXiv manuscript with its own jupyter-based deps) — none in the shipped spotoptim package. Bumped the vulnerable transitive deps to patched versions:

package	before	after	fixes
idna	3.11	3.17	≥3.15
mistune	3.2.0	3.2.1	≥3.2.1
urllib3	2.6.3	2.7.0	≥2.7.0 (2 high)
jupyterlab	4.5.6	4.5.7	≥4.5.7
notebook	7.5.5	7.5.6	≥7.5.6
jupyter-server	2.17.0	2.19.0	≥2.18.0

Dependabot re-scans bart26g/uv.lock once this lands on main and should close all 18 alerts. Also restamps the main uv.lock spotoptim version 0.12.1 → 0.12.4 to match pyproject.toml (the lock had drifted after the semantic-release bump).

Note: these are build/authoring deps for a paper, not runtime deps of the toolbox. If you'd rather Dependabot not track the paper subproject at all, a follow-up could add a scoped .github/dependabot.yml — say the word.

Commit types

ci: and chore(deps): — neither triggers a semantic-release version bump.

🤖 Generated with Claude Code