build(deps): bump build 1.6.1, tzdata 2026.4, pyproject-hooks 1.3.3, pyjwt 2.14.0

[pengfei-threemoonslab]

Carries the four open Dependabot lock bumps in one change, so they need one CI run under the strict up-to-date rule instead of four. This supersedes #881, #882, #883 and #884. Dependabot closes each one once main carries its version.

package	from → to	lock(s)	Dependabot PR
build	1.6.0 → 1.6.1	dev.txt, release-seal.in, release-seal.txt	#881
tzdata	2026.3 → 2026.4	dev.txt	#882
pyproject-hooks	1.2.0 → 1.3.3	dev.txt	#883
pyjwt	2.13.0 → 2.14.0	dev.txt	#884

Why #881 is not merged as-is

All four of #881's suite jobs failed within 30 seconds at Verify the dependency locks. Dependabot regenerated constraints/release-seal.txt with its own pip-compile, and that rewrite:

• wrote pydantic[email]==2.13.5, which scripts/verify_dependency_lock.py cannot parse;
• dropped the platform_python_implementation != 'PyPy' markers on cffi and pycparser;
• deleted the Windows-only colorama==0.4.6 ; os_name == 'nt';
• left declares: build==1.6.0 in the header.

Here the seal lock changes only in build's pin, its two hashes and the declares line.

Checks

• Every new hash matches PyPI's published sha256 digests for that version.
• requires_dist is unchanged between the old and new version of each package, so no closure widens.
• Each hand edit is byte-identical to a pinned uv 0.12.9 uv pip compile --universal --generate-hashes run that keeps the existing pins as preferences. A bare scripts/update_locks.py has no preferences and would also move eight unrelated seal pins, so it was not used.
• scripts/verify_dependency_lock.py passes for all four locks locally.
• tests/test_release_pipeline.py and tests/test_release_engine_smoke.py pass locally.

#885 (the claude-agent-sdk floor in harness/requirements.txt) is left out on purpose. That file says to raise the floor only after re-running the smoke and a paid Sonnet cell.

🤖 Generated with Claude Code