fix(security): refresh vulnerable runtime dependencies

[descambiado]

Summary

• upgrade cryptography from 49.0.0 to 50.0.0 across API, package metadata and the hash-pinned worker
• refresh brace-expansion and nanoid to fixed transitive versions
• preserve the existing fail-closed preflight and disabled job issuance behavior

Verification

• pip-audit: no known vulnerabilities
• BOFA verifiers: 9/9 relevant control-plane, execution, identity and worker checks passed
• npm audit --audit-level=high: passed
• ESLint: 0 errors (8 pre-existing warnings)
• TypeScript: passed
• Vite production build: passed

Local note

The Windows-only runtime timing check 'flow cancel drain swallows task exception' remained flaky locally; the unchanged check is left for the Linux CI runner to arbitrate.