chore(deps): bump uv.lock and pre-commit hook pins

ruff v0.11.13 -> v0.15.21, mypy v1.16.0 -> v2.2.0, bandit 1.8.5 -> 1.9.4,
pre-commit-hooks v5.0.0 -> v6.0.0, betterleaks v1.1.2 -> v1.6.1.
uv.lock: mypy, ruff, pip-audit, pip, and transitive deps to latest.

Verified ruff check / mypy still pass; the 5 existing E501 findings
and mypy's tools/lib github-deploy-key.py duplicate-module warning
pre-date this bump (confirmed against the old pinned versions too).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019nR4GeGS2EDhLypRNm1JhW

Author: adamamyl

.pre-commit-config.yaml

@@ -1,25 +1,25 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.13
+    rev: v0.15.21
     hooks:
       - id: ruff
         args: [--fix]
       - id: ruff-format
 
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.8.5
+    rev: 1.9.4
     hooks:
       - id: bandit
         args: ["-c", "pyproject.toml"]
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.16.0
+    rev: v2.2.0
     hooks:
       - id: mypy
         additional_dependencies: ["types-requests"]
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-json
       - id: check-yaml
@@ -29,6 +29,6 @@ repos:
         args: [--branch, main]
 
   - repo: https://github.com/betterleaks/betterleaks
-    rev: v1.1.2
+    rev: v1.6.1
     hooks:
       - id: betterleaks