Dependencies: py3.12 floor + core blinding stack (fork pin, cryptography, sacc) #242

Make the core blinding stack installable and reproducible: the UNIONS-WL Smokescreen fork plus its closure as core dependencies of sp_validation (no [blinding] extra). Delivered by PR #243.

Desired end state

• Smokescreen installs from a single git pin into UNIONS-WL/Smokescreen — SHA on the fork's packaging branch for now, swapped to the fork's release tag before merge. At the pinned ref the fork declares pyccl and lazy-imports its theory backends, so the resolved closure is CCL-only: no firecrown, no numpy ceiling anywhere in the graph.
• sacc>=0.12 and cryptography declared explicitly in core dependencies, so the runtime closure is self-documenting and independent of fork-metadata drift.
• uv.lock resolves the fork ref cleanly.
• Dockerfile and CI unchanged: the closure is core, so the existing install line covers it, and an install failure of the fork pin already fails the image build.

(The requires-python >= 3.12 floor originally scoped here landed on develop independently via cosmo-numba.)

Acceptance

• A clean uv install resolves the pinned fork plus pyccl, cryptography, and sacc>=0.12, with no firecrown and no numpy ceiling.
• The test suite runs green inside the freshly built image.

— Fable on behalf of Cail.