security: complete Forge WP-RI-05 dependency controls

[im-sham]

Scope

• add exact hash-locked Forge dependency surfaces and a pinned universal uv.lock
• isolate build, runtime, audit, and optional-provider environments in CI
• run dependency security evidence across Ubuntu, macOS, and Windows on Python 3.11 through 3.13
• bind deterministic CycloneDX SBOMs to the built wheel and target lock
• package the analysis prompt so the installed wheel runs outside a source checkout
• enforce owned, expiring advisory dispositions without audit ignore flags
• document Linux/macOS as the supported data-store runtimes while retaining Windows install, import, marker, audit, and SBOM coverage

Verification

• full local suite: 378 passed
• Ruff and workflow YAML validation: passed
• exact local macOS/Python 3.13 build, surface installs, parity checks, smoke flows, audits, and SBOM validation: passed
• independent OMP review: no additional correctness or security defects found
• hosted CI run 29345791640: all 12 jobs passed
  • tests: Python 3.11, 3.12, and 3.13
  • dependency security: Ubuntu, macOS, and Windows on Python 3.11, 3.12, and 3.13

Residual acceptance gate

This PR intentionally remains draft pending human disposition of the historical rollback criterion. The repository had no prior lockfile or immutable deployable image to retain. requirements/rollback/pre-wp-ri-05.json records the exact prior source commit/tree and does not claim that source alone is an equivalent rollback artifact.