Dependency refresh, sunset 3.11

[aaTman]

Summary

Fixes an install failure from a hard cartopy==0.24.1 pin, then audits the rest
of the tree. All four == pins traced back to one commit (144b1e4) where they
were CI workarounds, not real constraints.

• Unpinned everything. cartopy, eccodes, frozenlist, pyogrio,
  virtualizarr — no == left in published metadata. eccodes and
  frozenlist are gone entirely (never imported); pyogrio already comes via
  geopandas. Swapped kerchunk[dev] (kerchunk's own test extra, which is what
  dragged in cfgrib → eccodes) for kerchunk>=0.2.10 + fastparquet, and
  dropped the kerchunk git override. Added shapely, previously a transitive
  import.
• cartopy out of core. Its only use was shapereader.natural_earth in
  utils.py; replaced with pooch + geopandas, verified identical across all
  3 resolutions x 3 layers. Now lives in data-prep for the plotting scripts.
• Python 3.12–3.14. 3.11 dropped (icechunk 2.x and virtualizarr 2.7 need
  3.12+); 3.14 added, now possible because cartopy publishes no cp314 wheels.
  CI was testing 3.10, which contradicted the old floor. Bumped CI uv 0.5.6 →
  0.12.3 so it recognizes cp314 tags.
• Relocked with floors kept permissive. Only numba>=0.66 (it's what caps
  numpy), icechunk>=2.1.2, virtualizarr>=2.7.3 moved.
• Capped pandas<3. It was unbounded, so users already got 3.0.5 while the
  lock sat on 2.3.3. Tested it: 11 failures. Migration deserves its own PR.
• Fixed 10 tests relying on behavior numpy 2.4 and sparse 0.19 removed
  (1-d→scalar coercion, implicit densification). Library code was already
  correct; fixed the tests rather than capping numpy/sparse.

Verification

1093 tests pass, pre-commit and deptry clean, wheel metadata has no == pins or
git URLs, and ewb now resolves alongside cartopy==0.25.0.

Not verified locally: the suite hasn't run on 3.14 (no interpreter available)
— evidence is a wheels-only resolve succeeding. CI will prove it.

Breaking

Sunsets Python 3.11 support. pip install extremeweatherbench no longer brings
cartopy — use [data-prep] or depend on it directly.