deps: refresh all lockfiles and upgrade the python dev stack

[dekobon]

Routine maintenance sweep: refresh every lockfile in the repository, upgrade the
Python dev stack, and take the one hook bump that dependabot does not cover.
Three commits, no source changes.

What moved

Area	Change
Root Cargo.lock	70 crates within semver — actix-web 4.14.1 → 4.15.0, the futures 0.3.33 → 0.3.34 family, the gix-* family, aws-lc-rs, cc, clap_mangen
7 excluded crates	enums, fuzz, and the five vendored tree-sitter-* — cc and find-msvc-tools only, to the root lockfile's versions
uv.lock + exports	24 packages — ruff 0.16.2 → 0.16.4, mypy 2.3.0 → 2.3.1, numpy 2.5.1 → 2.5.2, the jupyter/notebook stack
.pre-commit-config.yaml	pre-commit-hooks v5.0.0 → v6.0.0; ruff rev mirrored to v0.16.4
man/bca-report.1	Regenerated — dependency-induced, see below

Why a man page moved in a dependency PR

clap_mangen 0.3.3 stopped emitting hide = true positionals into the SYNOPSIS
line, so the regenerated bca-report page no longer advertises [FORMAT].

That corrects an upstream bug rather than dropping an option. format_positional
is hide = true and still parses; bca report --help has always printed
bca report [OPTIONS]; the page's own OPTIONS body never documented the
positional; and every other hidden argument (--headroom,
--strict-exit-codes, --no-cyclomatic-try) was already omitted from the man
pages. The deprecated positional is unaffected at runtime — this only brings it
in line with its siblings.

Worth flagging for future dependency bumps: the manpages pre-commit hook
excludes Cargo.lock from its trigger, so a local hook run would not have
produced this regeneration. It surfaced from make pre-commit.

Why the excluded crates are in the same commit

The seven workspace-excluded crates root their own workspaces, so
cargo update --workspace never reaches them and their locks had drifted behind
on cc and find-msvc-tools. Each moved exactly those two packages, with
byte-identical checksums. This matches 38a8f36, which refreshed the root
workspace and each excluded crate in one commit.

Why the ruff rev is in the Python commit

check-ruff-lockstep treats uv.lock as the anchor: the ruff-pre-commit
rev: must be v + the version it resolves, and the requirements/dev.txt
export must pin it. Splitting them would leave the intermediate commit red. The
pyproject.toml bound (>=0.13,<0.17) already covers 0.16.4 and is unchanged.

Verification

make pre-commit → BCA_GATE: pass (gate=pre-commit)

• 5,364 Rust tests pass (10 skipped); 363 Python tests pass (1 xfailed)
• clippy in both feature flavours, udeps, rustdoc, manpage drift, self-scan at
  both tiers, enums-codegen-drift, check-publish-metadata
• Full Python stack present rather than skipped: ruff, mypy, pyright, pytest,
  stubtest
• make fuzz-check passes separately, since fuzz/Cargo.lock sits outside the
  make pre-commit DAG
• cargo deny check → advisories, bans, licenses, sources all ok
• cargo metadata --locked resolves

Pin policy

Grammar crates are untouched. All twenty plus the tree-sitter runtime remain at
their =X.Y.Z pins. The h2 0.4.18 entry from 04d83b5 (RUSTSEC-2026-0258)
survives the re-resolve, and no bumped crate declares a rust-version above the
workspace MSRV of 1.94.

No public-API change; STABILITY.md is unaffected.

Built and gated against Rust stable 1.98.0 and nightly 1.100.0.