chore(workflow): today-mode 2026-06-30 + Dependabot land batch

[FabioLeitao]

Summary

• FASE 0: OPERATOR_TODAY_MODE_2026-06-30 (+ pt-BR), CARRYOVER archive (GA 1.7.4, three-fronts/gate chore: release gate checklist for 1.7.4 — Maestro bugs + benchmark parity #406, ci+docs+workflow: Python 3.12/3.13 test matrix and maintenance front-of-work #91/docs(plans): v1.8.0 detection taxonomy survey (#1056) #1062), PUBLISHED_SYNC verified 2026-06-30.
• FASE 1 (local apply): hatchling>=1.30.1 (deps(uv): update hatchling requirement from >=1.29.0 to >=1.30.1 #915), dependency-review-action v5 (ci(actions): bump actions/dependency-review-action from 4.8.0 to 5.0.0 #1011), sonarqube-scan-action v8.2 (ci(actions): bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 #912).
• Issues: [P3][detection] PII seed '192.168' (RFC1918) colide com a regex — avaliar FP-proneness + seed word-boundaried #1089–[P3][chore] R12.2 — micro-fix cosmético do $totalFails (exit-code), nunca aplicado/testado #1092, [P2·G2·U2] feat(licensing): enum Tier sem Pro+/Partner-custom — ladder #853 não-enforced no código → deferir 1.8.0-beta (GAP, não-block) #887 closed (shipped in feat(licensing): Std/Pro+/Partner tiers + security hardening slice #1097); [P2][security] triar as 4 vulns do Dependabot na default-branch (1 high / 2 moderate / 1 low) #1096 triage comment.

Dependabot PRs to close after merge

• deps(uv): update hatchling requirement from >=1.29.0 to >=1.30.1 #915, ci(actions): bump actions/dependency-review-action from 4.8.0 to 5.0.0 #1011, ci(actions): bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 #912 — superseded by this branch
• Deferred (RED): deps(uv): bump the uv-minor-patch group across 1 directory with 31 updates #1025 (uv ×31), deps(docker): bump python from 3.13-slim to 3.14-slim #1029 (docker 3.14), deps(uv): bump torch from 2.10.0 to 2.12.1 #975 (torch major) — need dedicated slices; rpds-py cap ADR-0069 unchanged

Test plan

• ./scripts/check-all.sh

Made with Cursor