[goetchstone]

What and why

Takes the five pending Dependabot bumps in one universal lock. Dependabot's pip-ecosystem PRs (#56–#60) regenerated the locks for a single Python, which dropped the environment markers, so tests/test_locks.py failed them. See build-packaging.

• setuptools 84.0.0 → 84.1.0, certifi 2026.7.22 → 2026.10.19, opentelemetry-api 1.45.0 → 1.45.1, uv 0.13.1 → 0.13.4 (pyproject + dev.in)
• make lock with uv 0.13.4; no other pins move

Supersedes #56, #57, #58, #59, #60.

How it was verified

• .venv/bin/python -m pytest -q passes
• make lint is clean (ruff + mypy)
• A screen changed: make a11y passes and docs/guide.md says what's new

1605 passed, 4 skipped, run in a venv installed from the new dev.txt with --require-hashes.

If it builds or runs a gam command

N/A.

Live status: N/A (dependencies only).

Nothing private

• No credentials, real domain names, real addresses, or captures from a real tenant (screenshots come from scripts/readme_screenshots.py)

🤖 Generated with Claude Code