chore: refresh uv.lock files - #78

Summary

Refresh the resolved dependency lockfiles with uv lock --upgrade — root project and the bundled minimal_workspace scaffold. No pyproject.toml changes; lockfile refresh only.

marimo is deliberately held at 0.23.13 here and bumped separately (#77), because bumping it requires the coupled onboarding-notebook session snapshot (metadata.marimo_version) to move in lockstep (tests/test_notebook.py::test_snapshot_marimo_version_matches_lock).

Root uv.lock (dev/build toolchain, not user-facing):

• dlt 1.28.2 → 1.29.0, sqlglot 30.12 → 30.13, gitpython, jsonpath-ng 1.7 → 1.8, mypy, posthog, ruff, tomlkit; removes ply

minimal_workspace/uv.lock (ships to users):

• dlt 1.28.2 → 1.29.0, dlthub 0.27.0 → 0.29.0
• sqlglot 28.0 → 30.13 (major jump)
• cyclopts, narwhals, opentelemetry-api, anyio; AWS/async transitives (aiobotocore 3.7 → 3.8, botocore 1.43.0 → 1.43.46, aiohttp, yarl)
• Drops the python-jose crypto stack (python-jose / rsa / ecdsa / pyasn1) plus ply / ruamel-yaml; joserfc bumped 1.7.3 → 1.7.4

CHANGELOG [Unreleased] → Changed entry added for the scaffold refresh (user-facing-only convention; root dev-tool bumps not listed).

Tests

• make lock-check and make scaffold-lock-check pass (both lockfiles in sync with their pyproject.toml).
• test_snapshot_marimo_version_matches_lock passes (marimo held at 0.23.13, matching the unchanged snapshot).

🤖 Generated with Claude Code