PROJ-025/FEAT-001: Unblock the Dependabot PR Backlog #417

What this is: the feature that gets ten queued Dependabot updates onto main without breaking Jerry. Parent: #415.

Done when:

• The ten Dependabot pull requests listed in the enabler sub-issue are merged to main, or closed with a recorded reason (for example, superseded by a newer Dependabot pull request).
• The first scheduled security scan after the last update lands no longer reports the pip, httpcore2, httpx2, anyio, urllib3, or virtualenv findings listed in Security Alert: CVEs found in dependency tree #385 on 2026-10-23.
• CI on main passes after each update lands.

Out of scope: certifi, also flagged in #385, has no Dependabot pull request in this set and needs separate tracking.

Children: one enabler issue, linked below as a sub-issue.

Tracking: worktracker feature FEAT-001, in projects/PROJ-025-tactical-work-q4y2026/work/EPIC-001-dependency-update-flow/FEAT-001-unblock-dependabot-backlog/.