deps: everything to latest stable

Python 3.12 -> 3.14, postgres 16 -> 18, uv 0.5.11 -> 0.11.29,
trivy 0.58.1 -> 0.72.0, gitleaks 8.21.2 -> 8.30.1, yq 4.44.6 -> 4.53.3,
and every action re-pinned to the SHA of its latest tag (checkout v7,
setup-uv v8, buildx v4, login v4, hadolint v3.3.0). helm stays 3.21.3:
already current for 3.x, and helm 4 is a breaking change, not a CVE fix.

trivy mattered most. A vulnerability scanner fourteen minor versions behind is
the one stale pin that hides all the others.

ruff target-version is deliberately py313 while the runtime is 3.14. It
controls the syntax the formatter may emit, and at py314 it rewrites
'except (A, B):' into PEP 758's unparenthesized form — which reads exactly
like Python 2's 'except E, name:' and is a hard SyntaxError below 3.14. No
semantic gain, real readability cost, in a repo meant to be read.

Verified on 3.14: ruff, ruff format, mypy --strict, 166 tests, helm lint,
bandit, pip-audit. The digest guard still rejects placeholder digests.

Risk carried knowingly: the bumped actions run on node24. If act_runner only
provides node20, every job fails at action startup and this commit is the
revert.

pyproject.toml

@@ -2,7 +2,7 @@
 name = "svcforge"
 version = "0.1.0"
 description = "X-as-a-Service control plane — reference implementation"
-requires-python = ">=3.12"
+requires-python = ">=3.14"
 dependencies = [
     "svcforge-core",
     "fastapi>=0.115",
@@ -54,7 +54,18 @@ svcforge-core = { path = "libs/svcforge_core", editable = true }
 
 [tool.ruff]
 line-length = 110
-target-version = "py312"
+# py313, while the project RUNS on 3.14. `target-version` controls the syntax the
+# formatter is allowed to EMIT, and at py314 it rewrites `except (A, B):` into PEP 758's
+# unparenthesized `except A, B:`.
+#
+# That rewrite is rejected here for two reasons. It is visually identical to Python 2's
+# `except E, name:`, which binds a variable rather than catching two types — a reader who
+# learned Python 2, or an LLM trained on it, reads the opposite of what it does. And it
+# makes the source a hard SyntaxError on 3.13 and earlier for no semantic gain, in a repo
+# whose job is to be read.
+#
+# Raise this only for syntax that earns its incompatibility.
+target-version = "py313"
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "UP", "B", "ANN", "S", "C4", "RUF"]
@@ -91,7 +102,7 @@ exclude_dirs = [".venv", "tests"]
 
 [tool.mypy]
 strict = true
-python_version = "3.12"
+python_version = "3.14"
 warn_unreachable = true
 
 [[tool.mypy.overrides]]