Fix dependency security alerts and stabilize lock checks

[bifrost0x]

What changed

• update cryptography to 50.0.0 and socket.io-parser to 4.2.7
• harden the vendored Socket.IO decoder against invalid attachment counts
• make Python lock checks deterministic across hosts by reusing committed pins and targeting Python 3.11
• add regression tests for both advisories and the lock policy

Why

The default branch reports three high-severity dependency alerts. The lock check also re-resolved dependencies from an empty temporary file, allowing new transitive releases or host-specific Python markers to make CI fail without a repository change.

Validation

• 1313 Python tests passed, 33 skipped
• 73 JavaScript tests passed
• 33 Playwright tests passed
• lock check passed with uv 0.10.9
• vendor check passed
• npm audit: 0 vulnerabilities
• pip-audit: no known vulnerabilities