release: roll up Dependabot updates in v0.5.1

[vicotrbb]

Summary

• consolidate every applicable open Dependabot update into one release change
• upgrade JavaScript tooling, Rust dependencies, mypy, uv container/CI tooling, and pinned GitHub Actions
• adapt PKCE entropy generation to Rand 0.10's Rng trait without changing the verifier/challenge contract
• resolve the new high-severity js-yaml and brace-expansion audit findings
• synchronize all product, chart, installer, documentation, lockfile, and cache-busting versions at 0.5.1

Dependabot disposition

Included: #20, #22, #23, #24, #26, #27, #28, #29, #30, #37, #38, #39, #40, #41, #42, #43, and #44.

Superseded: #31 is fully covered by the newer markdownlint-cli2 0.23.2 / js-yaml 5.2.2 update from #44.

Notable compatibility work

• Rand 0.10 moved fill_bytes from the old root RngCore export to the Rng trait. The CLI import is updated and the existing PKCE high-entropy/S256 test continues to pass.
• The mypy requirement is widened to <3 and the lockfile is intentionally advanced to mypy 2.3.0, so CI validates the actual major upgrade rather than only permitting it.
• uv is synchronized at 0.11.32 across both images and controller CI.
• GitHub Action SHAs were independently matched to their advertised immutable tags before commit.

Validation

• npm ci, full JavaScript/documentation lint, and npm audit --audit-level=high (0 vulnerabilities)
• controller Ruff formatting/lint, mypy 2.3.0, 157 tests at 88.67% coverage, and pip-audit (0 known vulnerabilities)
• CLI formatting, clippy with warnings denied, 25 tests, and cargo audit (0 known vulnerabilities)
• ShellCheck, terminal compatibility, version consistency, Helm Insights/GPU/custom-image contracts, rendered-chart validation, and strict kubeconform validation
• gitleaks scan (no leaks)
• controller and workspace image builds; both report uv 0.11.32; workspace terminal/GPU-group image regression passed
• isolated Kind lifecycle passed install, custom images, GPU profile, Insights ingestion/deduplication/durable outboxes, API, PVC retain/reuse/purge, NodePort, SSH, controller/workspace restarts, and cleanup

After protected checks pass, this PR is intended to be merged and tagged as v0.5.1.