Dependency upgrade only. No code changes.
The lock file is what moved. The image, CI and Render install from uv.lock, so this upgrades it within the existing constraints (the redis<8 pin holds). Notable jumps: anthropic 1.2 to 1.11 and pydantic-ai 2.36 to 2.52 for the safety investigator, argon2-cffi-bindings 25 to 26, authlib 1.8, pyjwt 2.15, pymongo 4.18, starlette 1.7, uvicorn 0.54 and sentry-sdk 2.71.
requirements.txt follows the lock. Its pins now match uv.lock line by line for Railway, a test fails if the two ever disagree, and dependabot watches uv instead of pip so future bumps change the file that actually gets installed.