Deps: lock refresh (iniconfig, lefthook, tomli)

[vvillait88]

Summary

Lock refresh from the dependency sweep. uv lock --upgrade moves three dev and test packages: iniconfig 2.3.0 to 2.3.1, lefthook 2.1.17 to 2.2.0, and tomli 2.4.1 to 2.5.0. No manifest changes and no runtime dependency moves, so this ships nothing to users and needs no release.

Worked with Varun, who asked for the sweep. Not done: nothing held back; the lock has no prerelease versions.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

uv sync --all-extras --all-groups, then ruff check, ruff format --check, ty check, vulture (as CI runs it) and pytest (177 passed, 2 skipped), all green locally.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests