build: coordinate dependency updates and MCP 2.1 smoke

[veil-chow-fyaic]

Outcome

Consolidates the broken one-file Dependabot updates into one verified maintenance change and removes the wildcard review rule that automatically requested a personal review on every repository change.

Changes

• upgrades the Python runtime/development groups from build(deps-dev): bump the python-development group across 1 directory with 3 updates #64 and build(deps): bump the python-runtime group across 1 directory with 5 updates #65 with a regenerated lock;
• coordinates the uv 0.12.8 pin from build(deps): bump astral-sh/uv from 0.12.1 to 0.12.8 #61 across Docker, CI, release, acceptance and documentation;
• adapts the MCP 2.1 anticipated-error boundary so unavailable sources remain sanitized and fail closed;
• adds stdio MCP to the isolated live four-source CLI/REST/CRM parity gate;
• fixes the Redocly 2.49.0 execution pin left inconsistent after build(deps-dev): bump @redocly/cli from 2.44.2 to 2.49.0 #62;
• scopes CODEOWNERS to governed/security-sensitive paths;
• moves version-update cadence to quarterly, limits concurrent update PRs, and disables uncoordinated Docker version PRs while retaining security updates;
• adds the dependency labels referenced by Dependabot.

Python 3.14 from #63 is intentionally not included: it is a runtime major migration, not a patch update, and its Compose acceptance currently fails the repository's supported Python 3.13.14 contract.

Verification

• ./scripts/check.sh: 2,088 tests, 100% statement/branch coverage, package/docs/OpenAPI/secret/dependency checks pass; no known vulnerabilities.
• ./scripts/test_compose.sh: full PostgreSQL 18.4 reference deployment passes with zero project residue.
• ./scripts/test_official_screening_live.sh: current four-source refresh/replay and CLI/REST/CRM/MCP parity pass with zero residue (EU FSF 6,234; Annex I 384; OFAC SDN 19,321; Consolidated 481).
• Stale-source and invalid-input MCP paths remain fail closed; no mutating/clearance tool is exposed.

Evidence: docs/evidence/dependency-and-mcp-smoke-2026-09-02.md.

Relates to #47. Supersedes #61, #64 and #65 after merge.