Upgrade W&B to 0.28

[bradhilton]

What changed

• upgrade the backend W&B pin from 0.25.0 to 0.28.0
• pin Click 8.2.0 through ART's existing uv override mechanism because W&B 0.28 requires Click >=8.2 while SkyPilot 0.11.1 declares Click <8.2
• refresh only the affected lock entries

Why

Caladan is moving to W&B 0.28.0 and ART should exercise the same artifact and run behavior. The Click override is the smallest resolvable compatibility bridge; both W&B and SkyPilot CLIs were exercised under the combined environment.

Validation

• full prek run --all-files: passed (Ruff, format, ty, lock check)
• exact backend/Tinker CI unit command: 276 passed, 3 skipped
• wandb --help: passed
• sky --help: passed
• imports verified: W&B 0.28.0, SkyPilot 0.11.1, Click 8.2.0

A raw repository-wide pytest invocation is not a supported single environment because the Megatron, backend, and Tinker extras are intentionally split; the applicable CI matrix command above passed.