Maintenance sweep: uv 0.13, fastapi 0.143, pydantic 2.14

[vvillait88]

Summary

• Relock: fastapi 0.142.4 to 0.143.0, pydantic 2.13.5 to 2.14.0 (pydantic-core 2.50.0), ruff 0.17.0, ty 0.0.86, lefthook 2.2.1, plus transitives (bitarray, cytoolz, dnspython, google-api-core, httptools, pycparser, rich-toolkit). The lock also gains Python 3.15 resolution markers and cp315 wheels.
• CI on uv 0.13.0 and astral-sh/setup-uv 10.3.0, so the 3.15 matrix leg tests the final release rather than rc3. pip-audit moves to Python 3.14 (setup-python has no 3.15.0 build yet).
• No version bump: the declared ranges did not move, so the published wheel is unchanged.

Worked with Varun.

Not taken: the web3<8 constraint stays, because pympp 0.11.0 (latest) still requires eth-abi<6. Every capped dependency (cdp-sdk 1.48.2, redis 8.1.0, joserfc 1.7.5, x402 2.25.0, pympp 0.11.0, a2a-sdk 1.2.2, httpx 0.28.1) is already on its latest release. The only prerelease in the lock is OpenTelemetry's never-stable semantic-conventions (0.66b1), which prerelease = "if-necessary" admits by design.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

Locally on Python 3.15.0: ruff check, ruff format --check, ty on the package and on examples, vulture, and pytest (1673 passed, 4 skipped) all exit 0. The suite also passes on 3.15 under the previous lock. OSV scan clean.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (none changed)
• No secrets, credentials, or personal data in the diff or the tests