fix: update vulnerable Python dependencies

[abrichr]

Summary

• require Cryptography 50.x on every supported platform
• update the locked Cryptography version from 49.0.0 to 50.0.0
• update the transitive GitPython lock from 3.1.56 to 3.1.57
• build Cryptography 50 from its locked source archive on Intel macOS because PyPI does not publish an Intel wheel
• link the Intel source build statically to Homebrew OpenSSL and retain the frozen-sidecar refusal for external OpenSSL linkage
• audit the exact locked dependency set on both Ubuntu and macos-15-intel

Security basis

PYSEC-2026-3552 affects Cryptography 44.0.0 through 49.0.0 and is fixed in 50.0.0. The former Intel pin at 48.0.0 was affected. A proposed 43.0.3 fallback avoids that one advisory but has seven other known advisories, so this PR does not use it.

• https://api.osv.dev/v1/vulns/PYSEC-2026-3552
• GHSA-g6cj-pr64-35w5

Local verification

• exact hash-locked Python dependency audit: no known vulnerabilities
• explicit Cryptography 43.0.3 audit: rejected with seven known vulnerabilities
• focused signing, qualification, frozen-engine, static-link, workflow, and release-contract tests: 75 passed, 3 skipped
• Ruff: pass
• uv lock --locked: pass
• git diff --check: pass

Required GitHub evidence

The PR adds an Intel-specific dependency-audit job. After this head passes its normal checks, run Build artifacts by workflow_dispatch on this branch. The macos-15-intel matrix leg must source-build Cryptography 50, verify the frozen sidecar, build the DMG, and pass install, launch, and uninstall smoke tests before merge.

Coordination

This remains separate from #101 and #102. Neither PR changes these dependency files. Rebase both onto main after this PR merges.

[abrichr]

Exact-SHA artifact proof passed at 33c918143177acbbc1d49292678423367dd290d7: Build artifacts run 31055578477. All jobs passed, including Native installer (macOS Intel): locked Cryptography 50 source build, frozen-sidecar validation, native packaging, and DMG install/launch/uninstall smoke. Linux, Windows, and macOS arm64 artifact jobs also passed. The normal PR checks are green, including both Python locked-dependency audits.