Maintenance sweep: uv 0.13.1, ruff 0.17.1, ty 0.0.89 (#109)

## Summary

Maintenance sweep for python-sdk. Lock and CI only; the published
package's requirements are unchanged, so this ships without a version
bump or release.

- Relocked to current: ruff 0.17.1, ty 0.0.89, lefthook 2.2.2, pluggy
1.7.0, certifi 2026.10.18. No prereleases in the lock.
- The uv pin in ci, publish and security moves from 0.13.0 to 0.13.1.
- The pip-audit job runs on Python 3.15, the current release, instead of
3.14.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: the main gate job still installs Python 3.12; the
matrix already covers 3.11 through 3.15. setup-uv v10.3.0,
gh-action-pypi-publish v1.14.2, setup-python v7, checkout v7, cache v6
and osv-scanner 2.7.0 are already current.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None.

## Test plan

Run locally: ruff check, ruff format --check, ty, vulture and pytest
(172 passed, 2 skipped, 99.81% coverage), each exit 0, plus pytest on
Python 3.15. osv-scanner 2.7.0 over uv.lock reports no issues across 24
packages.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
(nothing public changed)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
       - run: uv python install 3.12
       - uses: actions/cache@v6
         with:
@@ -49,7 +49,7 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
       - run: uv python install ${{ matrix.python }}
       - run: uv sync --frozen --all-extras --all-groups --python ${{ matrix.python }}
       - run: uv run --python ${{ matrix.python }} pytest tests/ -q

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -38,10 +38,10 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.14"
+          python-version: "3.15"
 
       - name: Install pip-audit
         run: pip install pip-audit