chore(repo): batch dependabot security + lint bumps and clear codeql no-op

[datascry]

Consolidates the stalled weekly Dependabot queue into one datascry-authored batch and clears every open security/quality alert. Each commit uses a valid component scope (the original bot PRs were red on commitlint because Dependabot's deps/deps-dev scope isn't in our scope-enum).

Security alerts cleared (15/15 Dependabot + 1 CodeQL)

• pillow 10.0 → 12.3.0 (evaders/arena-solver-ocr) — clears 10 high + 3 medium advisories; torch 2.2 → 2.13.0 clears 1 low. Supersedes chore(deps): bump the uv group across 1 directory with 2 updates #268.
• brace-expansion high (collector) — the collector dev-dep bump refreshes the lock to 2.1.2 / 5.0.7, both above the advisory's patched versions. Supersedes chore(deps-dev): bump the collector group across 1 directory with 3 updates #267.
• CodeQL js/identity-replacement medium — dropped the no-op .replace(/</g, "<") in home.js (< is <, so it did nothing; the value renders via textContent, which is never HTML-parsed).

Also in the batch

• fleet mypy >=2.3.0 (supersedes chore(deps-dev): update mypy requirement from >=2.2.0 to >=2.3.0 in /fleet #266) and ruff >=0.15.21 (supersedes chore(deps-dev): update ruff requirement from >=0.15.20 to >=0.15.21 in /fleet #265), plus a regenerated fleet/uv.lock — Dependabot's requirement bumps only edited pyproject.toml and left the lock stale (would fail uv lock --check). uv lock resolved mypy 2.3.0, ruff 0.15.22.
• actions/setup-node 6.4.0 → 7.0.0 (supersedes chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #264).

Verification

• Detector: ruff, mypy --strict, headers clean; 537 passed, 95.20% coverage (gate met).
• uv lock --check clean for fleet and arena-solver-ocr.
• collector (pnpm) and edge/arena (go) toolchains not available locally — dev-dep bumps only, no Go touched; CI validates.

Closes #264, #265, #266, #267, #268 once merged.

[datascry]

Added dc3e593 fix(edge): gofmt store_test.go — main was already red on the edge job since d20b08b (gofmt flagged internal/tcpfp/store_test.go, failing before vet/test). Applied gofmt -w; go vet + all edge tests pass in golang:1.26. Folded in so this PR lands green and unblocks every subsequent PR.