chore(deps): broad dependency modernization (explicit workflow)

[John Kennedy (jkennedyvz)]

Summary

This PR runs the explicitly invoked langster-modernize-all-dependencies-explicit workflow against the repository's single Python/uv package root. It is a broad modernization, not a routine Dependabot patch.

• raises every direct runtime, development, and build dependency lower bound to the latest stable release available on 2026-08-25
• regenerates uv.lock, including the compatible transitive dependency graph
• updates the deprecated setuptools license-table metadata to the SPDX string form required by modern setuptools

Dependency changes

• langgraph: 1.0.10 resolved / >=1.0.0 declared → 1.2.11
• python-dotenv: 1.2.2 resolved / >=1.0.1 declared → 1.2.3
• anyio: 4.12.1 → 4.14.2
• langgraph-cli[inmem]: 0.4.30 → 0.4.31
• mypy: 1.19.1 → 2.3.1
• pytest: 9.0.3 → 9.1.1
• ruff: 0.15.5 → 0.16.4
• setuptools: 83.0.0 minimum / 84.0.0 resolved → >=84.0.0
• wheel: unbounded build requirement → >=0.48.0

Caps and compatibility

• No maximum version caps existed, so none were removed, raised, or retained.
• Python remains >=3.10; all selected direct releases declare Python 3.10 compatibility.
• No application-code migration was required.
• Setuptools 84 surfaced a packaging deprecation; license = { text = "MIT" } was migrated to license = "MIT".

Validation

• uv lock --locked
• uv run ruff check .
• uv run ruff format . --check
• uv run mypy --strict src/
• uv run pytest tests/unit_tests -q — 1 passed on Python 3.12
• uv build
• Socket dependency scoring for all direct upgraded packages; no materially low score or vulnerability score
• Python 3.10/3.11 local unit runs were unavailable because the sandbox could not download the managed runtimes due to a certificate-chain failure; CI remains authoritative for 3.11/3.12
• credentialed integration tests were not run locally

Review hotspots / rollback

• Review the lockfile's LangGraph/LangSmith/CLI transitive major-minor movement, especially langgraph-api, langchain-core, and langsmith.
• Rollback is a single-commit revert of this PR.