Maintenance sweep: uv 0.13.1, ruff 0.17.1, ty 0.0.89

[vvillait88]

Summary

Maintenance sweep for python-sdk. Lock and CI only; the published package's requirements are unchanged, so this ships without a version bump or release.

• Relocked to current: ruff 0.17.1, ty 0.0.89, lefthook 2.2.2, pluggy 1.7.0, certifi 2026.10.18. No prereleases in the lock.
• The uv pin in ci, publish and security moves from 0.13.0 to 0.13.1.
• The pip-audit job runs on Python 3.15, the current release, instead of 3.14.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: the main gate job still installs Python 3.12; the matrix already covers 3.11 through 3.15. setup-uv v10.3.0, gh-action-pypi-publish v1.14.2, setup-python v7, checkout v7, cache v6 and osv-scanner 2.7.0 are already current.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

Run locally: ruff check, ruff format --check, ty, vulture and pytest (172 passed, 2 skipped, 99.81% coverage), each exit 0, plus pytest on Python 3.15. osv-scanner 2.7.0 over uv.lock reports no issues across 24 packages.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests