build(deps): raise nine dependency floors

[thellert]

Batches nine Dependabot dependency PRs into one branch so the full CI suite — including the e2e and agentic lanes — actually runs against them.

Dependabot-authored PRs run with the Dependabot secret store, which has no ALS_APG_API_KEY, so all four e2e/agentic lanes fail at the pre-flight guard on every one of them. Those PRs can only ever demonstrate that unit CI is green. Landing the bumps from a maintainer branch is the only way to get real e2e signal.

Included

Package	Floor	Locked
docker (dev)	>=7.0.0 → >=7.2.0	7.1.0 → 7.2.0
duckdb	>=1.5.1 → >=1.5.4	1.5.1 → 1.5.4
idna	>=3.10 → >=3.18	3.11 → 3.18
nltk	>=3.8.1 → >=3.10.0	3.9.2 → 3.10.0
ollama	>=0.5.1 → >=0.6.2	0.6.1 → 0.6.2
testcontainers (dev)	>=4.0.0 → >=4.14.2	4.14.1 → 4.14.2
tiled[client]	>=0.1 → >=0.2.14	0.2.12 → 0.2.14
urllib3	>=2.4.0 → >=2.7.0	2.6.3 → 2.7.0
uvicorn[standard]	>=0.27.0 → >=0.51.0	0.40.0 → 0.51.0

httptools 0.7.1 → 0.8.0 comes along transitively via uvicorn[standard].

These are floor bumps, but not no-ops: uv.lock had pinned resolutions older than several of the declared floors, so each one is a real upgrade — uvicorn by eleven minors.

Supersedes #429, #430, #431, #432, #434, #435, #436, #437, #438, which Dependabot will close once these requirements are satisfied.

Held back

• build(deps): bump claude-agent-sdk from 0.2.110 to 0.2.123 #433 (claude-agent-sdk 0.2.110 → 0.2.123) — the pin is ==, not a floor, and it vendors a ~247 MB CLI binary (2.1.191 → 2.1.215). The pin's own comment records the current CLI as verified against als-apg routing, and CHANGELOG history shows a past pin made precisely because a newer bundled CLI broke the CBORG proxy. It warrants its own PR with e2e signal rather than riding along here.
• build(deps): bump docker/login-action from 3 to 4 #426, build(deps): bump actions/setup-node from 6 to 7 #427, build(deps): bump docker/setup-buildx-action from 3 to 4 #428 (GitHub Action majors) — deliberately left to age.

Verification

• Full unit suite: 7934 passed.
• The ARIEL integration failures on this machine (stale ariel_test DB, pgvector migration skipped) reproduce identically on unmodified main, so they are unrelated to these bumps.