build: dependency refresh across the site, Python toolchain and workflow actions (#208)
* build(site): update docs site dependencies (astro 7.0.9, html-validate 11.5.6)
pnpm update --latest; lockfile verified against pnpm 11.13.1, the version
CI's corepack prepare pnpm@latest currently resolves. Build, internal link
validation, html-validate and pa11y (WCAG2AA) all pass.
* build(deps-dev): ruff >=0.15.21, mypy >=2.3.0, types-setuptools >=83.0.0.20260716
ruff check and mypy --strict are clean on the new versions with no new
rules firing. bandit, pytest and pytest-cov are already at their latest
releases. Runtime floors (numpy/scipy, optional matplotlib/numba) and the
pinned figure stack are unchanged: every requirements-figures.txt pin is
already the current release, verified by a full figure regeneration that
scripts/check_figures.py reports clean.
* ci: bump actions/setup-node to v7
ESM migration release; no behavioural change for our usage (plain
node-version, no built-in package caching). All other actions are already
at their current majors.
* docs: changelog entry for the dependency refresh