deps: everything to latest stable

Python 3.12 -> 3.14, postgres 16 -> 18, uv 0.5.11 -> 0.11.29,
trivy 0.58.1 -> 0.72.0, gitleaks 8.21.2 -> 8.30.1, yq 4.44.6 -> 4.53.3,
and every action re-pinned to the SHA of its latest tag (checkout v7,
setup-uv v8, buildx v4, login v4, hadolint v3.3.0). helm stays 3.21.3:
already current for 3.x, and helm 4 is a breaking change, not a CVE fix.

trivy mattered most. A vulnerability scanner fourteen minor versions behind is
the one stale pin that hides all the others.

ruff target-version is deliberately py313 while the runtime is 3.14. It
controls the syntax the formatter may emit, and at py314 it rewrites
'except (A, B):' into PEP 758's unparenthesized form — which reads exactly
like Python 2's 'except E, name:' and is a hard SyntaxError below 3.14. No
semantic gain, real readability cost, in a repo meant to be read.

Verified on 3.14: ruff, ruff format, mypy --strict, 166 tests, helm lint,
bandit, pip-audit. The digest guard still rejects placeholder digests.

Risk carried knowingly: the bumped actions run on node24. If act_runner only
provides node20, every job fails at action startup and this commit is the
revert.

AGENTS.md

@@ -45,8 +45,11 @@ Four things that look like over-engineering and are not. Do not "simplify" them:
 **Layers.** `transport → domain ← repo/adapters`. `domain/` imports nothing from the other
 three. `repo/` knows SQL and not HTTP. `adapters/` owns every subprocess and network call.
 
-**Python 3.12.** Full annotations everywhere including tests. `X | None`, `StrEnum`,
-`Final`, PEP 695 `type` aliases.
+**Python 3.14** at runtime, but ruff's `target-version` is pinned to `py313` so the
+formatter never emits 3.14-only syntax. Full annotations everywhere including tests.
+`X | None`, `StrEnum`, `Final`, PEP 695 `type` aliases. Keep `except (A, B):`
+parenthesized — PEP 758's unparenthesized form reads exactly like Python 2's
+`except E, name:`, which means something else.
 
 **Errors.** `SvcforgeError` in `svcforge_core/errors.py` is the base. New exception types
 inherit from it, plus a stdlib base when the behaviour matters (`HelmError(SvcforgeError,