chore(deps): remediate dependency alerts

[araujof]

Summary

Consolidates the open dependency maintenance work and remediates every current Dependabot alert on the default branch.

Closes #60

Changes

• Remove unused NLTK entirely, resolving all of its alerts, including GHSA-8mgp-746c-j5xp, which has no patched release.
• Upgrade vulnerable locked packages: cryptography to 50.0.1 in both lockfiles, Pillow to 12.3.0, pip to 26.2.1, setuptools to 84.0.0, and PyTorch to 2.13.0.
• Include all open Dependabot version updates:
  • chore(deps): Bump astral-sh/setup-uv from 5 to 7 #16: astral-sh/setup-uv v5 → v7
  • chore(deps): Update mcp requirement from >=1.0.0 to >=1.28.1 #28: mcp minimum 1.0.0 → 1.28.1
  • chore(deps-dev): Update pip-audit requirement from >=2.7.0 to >=2.10.1 #29: pip-audit minimum 2.7.0 → 2.10.1
  • chore(deps): Update networkx requirement from >=3.0 to >=3.6.1 #30: networkx minimum 3.0 → 3.6.1
  • chore(deps-dev): Update build requirement from >=1.2.0 to >=1.5.0 #31: build minimum 1.2.0 → 1.5.0
  • chore(deps): Update sentence-transformers requirement from >=2.2.0 to >=5.6.0 #32: sentence-transformers minimum 2.2.0 → 5.6.0
  • chore(deps): Bump actions/setup-python from 5 to 7 #35: actions/setup-python v5 → v7
• Regenerate both uv lockfiles and document the changes.

Closes: #16, #28, #29, #30, #31, #32, and #35.

Checks

• make ci (356 passed, 167 deselected)
• make build
• uv lock --check for the root and employee example projects
• pip-audit --skip-editable (no known vulnerabilities)
• CHANGELOG.md updated under ## [Unreleased]
• PR title uses a conventional prefix
• Commit is signed off for DCO
• make test (not run; policy behavior is unchanged)

[dhl123]

Make unit and Make integration all passed. LGTM