Deps security updates

[jarsarasty]

Update dependency versions to address security vulnerabilities:

• filelock 3.20.2 → 3.25.0 (CVE fixes)
• pip 25.3 → 26.0.1 (CVE fixes)
• virtualenv 20.34.0 → 21.1.0 (CVE fixes)
• Added python-discovery 1.1.0 (required by updated virtualenv)

Version constraints for direct dependencies are reflected in pyproject.toml. pip and virtualenv are uv's internal tooling and pinned in uv.lock.

[MichielTukker]

I see a lot of changes that don't really have anything to do with updating the dependencies due to security issues?

Do we have version requirements in the pyproject.toml for the dependencies?

[jarsarasty]

Hi @MichielTukker

You're right! This branch was originally based on a cleanup/refactoring branch, so it included those changes too. I've now rebased it onto main, so it only contains the security dependency updates.

Regarding version requirements: filelock already has a >=3.20.1 lower bound in pyproject.toml with a comment noting the security fix — we could tighten it to >=3.25.0 to reflect the latest update.

[jarsarasty]

Closing in favour of #35 (feature/simulator-worker-integration), which already includes these changes via cherry-pick. They will land in main when #35 is merged.